Generate temporary URL to reset password

Probably the easiest way is going to be to modify your users table to add 2 extra columns, OR if you don't want to modify the existing table you could add a new dependent table called "UserPasswordReset" or something like that. The columns are like this:

PasswordResetToken UNIQUEIDENTIFIER,
PasswordResetExpiration DATETIME

If you go with the additional table route, you could do also add the UserID column, make it a primary key and a foriegn key reference back to your users table. A UNIQUE constraint would also be recommended. Then you simply use a Guid in your asp.net application as the token.

The flow could be something like this:

1. User requests password reset for their account
2. You insert a new record in the table (or update their user record) by setting the PasswordResetExpiration to a date in the future (DateTime.Now.AddDays(1)), and set the token to Guid.NewGuid()
3. Email the user a link to your ResetPassword.aspx page with the guid in the query string (http://www.yoursite.com/ResetPassword.aspx?token=Guid-here)
4. Use the ResetPassword.aspx page to validate the token and expiration fields. (I.E. Make sure DateTime.Now < PasswordResetExpiration)
5. Provide a simple form that allows the user to reset this password.

I know you wanted to avoid modifying the database, but it really is probably the simplest method.

Here, the System.Guid class in your friend, as it will generate a unique (well, unique enough) 128-bit number:

• Generate a new Guid ( System.Guid.NewGuid() )
• Store that Guid somewhere (Application object maybe?)
• Send a custom URL in an email with that Guid
• When the user hits the site, make them enter the password you sent in the email
• If the passwords match, go ahead and force them to enter a new password

I used a Hashing Class to create unique automatic logins made up of the current date/time and the users email address:

string strNow = DateTime.Now.ToString();
string strHash = strNow + strEmail;
strHash = Hash.GetHash(strHash, Hash.HashType.SHA1);

get the Hash Class from: http://www.developerfusion.com/code/4601/create-hashes-md5-sha1-sha256-sha384-sha512/

Then just take it from the URL using:

if (Request.QueryString["hash"] != null)
{
                //extract Hash from the URL
                string strHash = Request.QueryString["hash"];
}

There is an issues with this approach. A safe hash makes the token really long. Either you integrate the salt into the hash itself (makes it about 20 charactes longer), or you store this unique salt in the database. If you store the salt in the database, you could as well store a random token which is not derrived from any existing

Depending on your needs, you could encrypt information, in a format similar to the following format

(UserId)-(ExpireDate)

Encrypt the data, make that the link, then decrypt the data and take action from there...

Crude, but most likely usable, and not requiring DB usage