DEV Community
•
2026-04-18 20:45
How to build a secure password reset flow in Next.js (the short version)
Last month I reviewed a friend's side project. He had 200 paying users, Stripe set up, a working dashboard. The password reset flow sent a reset token in a query string, stored it in plain text in Postgres, and never expired it. Anyone who read the database could take over any account, permanently.
He had written it in 2 hours. It looked fine. That is the problem with reset flows. They look fine ...