Go 密码重置 Token 入门：随机数、过期时间和一次性使用

func NewResetToken() (string, error) {
	var b [32]byte
	if _, err := rand.Read(b[:]); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b[:]), nil
}

func HashToken(token string) string {
	sum := sha256.Sum256([]byte(token))
	return hex.EncodeToString(sum[:])
}

type ResetToken struct {
	UserID    int64
	TokenHash string
	ExpiresAt time.Time
	UsedAt    *time.Time
}

func (s *Service) RequestPasswordReset(ctx context.Context, email string) error {
	user, err := s.users.FindByEmail(ctx, email)
	if err != nil {
		// 对外不要暴露邮箱是否存在
		return nil
	}

	token, err := NewResetToken()
	if err != nil {
		return err
	}
	record := ResetToken{
		UserID:    user.ID,
		TokenHash: HashToken(token),
		ExpiresAt: time.Now().Add(30 * time.Minute),
	}
	if err := s.tokens.Save(ctx, record); err != nil {
		return err
	}

	link := "https://example.com/reset-password?token=" + url.QueryEscape(token)
	return s.mailer.SendResetLink(ctx, user.Email, link)
}

func (s *Service) ResetPassword(ctx context.Context, token string, newPassword string) error {
	if len(newPassword) < 12 {
		return errors.New("password too short")
	}

	hash := HashToken(token)
	record, err := s.tokens.FindByHash(ctx, hash)
	if err != nil {
		return errors.New("invalid or expired token")
	}
	if record.UsedAt != nil || time.Now().After(record.ExpiresAt) {
		return errors.New("invalid or expired token")
	}

	passwordHash, err := HashPassword(newPassword)
	if err != nil {
		return err
	}
	if err := s.users.UpdatePassword(ctx, record.UserID, passwordHash); err != nil {
		return err
	}
	now := time.Now()
	return s.tokens.MarkUsed(ctx, hash, now)
}

func (s *Store) UseResetToken(ctx context.Context, tokenHash string, fn func(userID int64) error) error {
	tx, err := s.db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer tx.Rollback()

	var record ResetToken
	err = tx.QueryRowContext(ctx, `
		SELECT user_id, expires_at, used_at
		FROM reset_tokens
		WHERE token_hash = ?
	`, tokenHash).Scan(&record.UserID, &record.ExpiresAt, &record.UsedAt)
	if err != nil {
		return err
	}
	if record.UsedAt != nil || time.Now().After(record.ExpiresAt) {
		return errors.New("invalid token")
	}
	if err := fn(record.UserID); err != nil {
		return err
	}
	if _, err := tx.ExecContext(ctx, `UPDATE reset_tokens SET used_at = ? WHERE token_hash = ?`, time.Now(), tokenHash); err != nil {
		return err
	}
	return tx.Commit()
}

log.Printf("password reset requested user_id=%d", user.ID)

func (s *Service) CanSendReset(ctx context.Context, email string) (bool, error) {
	last, err := s.tokens.LastSentAt(ctx, email)
	if err != nil {
		return false, err
	}
	if time.Since(last) < time.Minute {
		return false, nil
	}
	return true, nil
}

// 不推荐：即使加了签名，也扩大了攻击面
link := fmt.Sprintf("https://example.com/reset?token=%s&uid=%d", token, user.ID)

func ValidateNewPassword(pw string) error {
	if len(pw) < 12 {
		return errors.New("密码至少需要 12 个字符")
	}
	var hasUpper, hasLower, hasDigit bool
	for _, c := range pw {
		switch {
		case 'A' <= c && c <= 'Z':
			hasUpper = true
		case 'a' <= c && c <= 'z':
			hasLower = true
		case '0' <= c && c <= '9':
			hasDigit = true
		}
	}
	if !hasUpper || !hasLower || !hasDigit {
		return errors.New("密码必须包含大小写字母和数字")
	}
	return nil
}

type AuditLog struct {
	Event     string    // "password_reset_requested" / "password_reset_completed"
	UserID    int64
	IP        string
	UserAgent string
	CreatedAt time.Time
}

func (s *Store) AtomicUseToken(ctx context.Context, tokenHash string) (int64, error) {
	result, err := s.db.ExecContext(ctx, `
		UPDATE reset_tokens
		SET used_at = ?
		WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?
	`, time.Now(), tokenHash, time.Now())
	if err != nil {
		return 0, err
	}
	rows, err := result.RowsAffected()
	if err != nil {
		return 0, err
	}
	if rows == 0 {
		return 0, errors.New("token already used or expired")
	}

	var userID int64
	err = s.db.QueryRowContext(ctx,
		"SELECT user_id FROM reset_tokens WHERE token_hash = ?", tokenHash).Scan(&userID)
	return userID, err
}

<p>你收到了这封邮件，是因为有人请求重置你在 example.com 的密码。</p>
<p><a href="{{.ResetLink}}">点击重置密码</a></p>
<p>此链接将在 {{.ExpiresIn}} 分钟后失效。</p>
<p>如果不是你本人操作，请忽略此邮件。</p>

func TestRequestReset_NonExistentEmail(t *testing.T) {
	err := svc.RequestPasswordReset(ctx, "notfound@example.com")
	if err != nil {
		t.Fatal(err)
	}
}

func TestResetPassword_InvalidToken(t *testing.T) {
	err := svc.ResetPassword(ctx, "invalid-token", "newpassword123")
	if err == nil {
		t.Fatal("expected error for invalid token")
	}
}

func TestResetPassword_TooShort(t *testing.T) {
	err := svc.ResetPassword(ctx, validToken, "123")
	if err == nil {
		t.Fatal("expected error for short password")
	}
}

record.ExpiresAt = time.Now().UTC().Add(30 * time.Minute)

func NewShortResetToken() (string, error) {
    var b [16]byte
    if _, err := rand.Read(b[:]); err != nil {
        return "", err
    }
    return base64.RawURLEncoding.EncodeToString(b[:]), nil
}

func resetFormHandler(w http.ResponseWriter, r *http.Request) {
    token := r.URL.Query().Get("token")
    if token == "" {
        http.Error(w, "missing token", http.StatusBadRequest)
        return
    }

    // 渲染表单时把 token 写进隐藏字段
    data := struct{ Token string }{Token: token}
    renderTemplate(w, "reset_form.html", data)
}