== Creating the password reset link

When creating a password reset link you need to make sure:

- It is a unique link with a random token
- You can use it only once
- The link is only valid for a limited amount of time.

Sending a link with a random token means an attacker cannot start a simple DOS attack to your website by starting to block users. The link should not be usable more than once, which makes it impossible to change the password again. The time-out is necessary to restrict the attack window. Having a link opens up a lot of possibilities for the attacker.

== Assignment

Try to reset Tom's password (tom@webgoat-cloud.org) to your own choice and log in as Tom with that password. Note: it is impossible to use OWASP ZAP for this lesson. Also, browsers might not work; command line tools like `curl` and the like will be more successful for this attack.

Tom is quick to act when it comes to his password. He always resets it immediately after receiving the email with the link.
