== Creating the password reset link

When creating a password reset link you need to make sure:

- It is a unique link with a random token
- It can only be used once
- The link is only valid for a limited amount of time.

Sending a link with a random token means an attacker cannot start a simple DOS attack to your website by starting to
block users. The link should not be usable more than once which makes it impossible to change the password again.
The time out is necessary to restrict the attack window, having a link opens up a lot of possibilities for the attacker.

== Assignment

Try to reset the password of Tom (tom@webgoat-cloud.org) to your own choice and login as Tom with
that password. Note: it is not possible to use OWASP ZAP for this lesson, also browsers might not work, command line
tools like `curl` and the like will be more successful for this attack.

Tom always resets his password immediately after receiving the email with the link.

