What is the general "User Password Reset" algorithm?

For example, after a user Email receives the password reset link, click the link to open the "Reset Password" Page. There are usually only two text boxes: Password box and Password confirmation box, in this case, how can I ensure security when users submit data? The main thing is how to ensure that the reset is actually in the Email link... for example, when the user Email receives Password ResetClick the link to open the" Reset Password"Page, there are generally only two text boxes: Password box and Password confirmation box, how to ensure security when the user submits? How to Ensure resetting It is indeed the user specified in the Email linkPassword (not someone else's password )?

Supplement:
In addition to a password box and a Password confirmation box mentioned above, I think there is a hidden box like User_id? It seems that modern browsers can modify the actual value of the hidden box, and then change the password of another person after submitting it!

Reply content:

For example, when a user receives an EmailPassword ResetClick the link to open the"Reset Password"Page, there are generally only two text boxes: Password box and Password confirmation box, how to ensure security when the user submits? How to Ensure resettingIt is indeed the user specified in the Email linkPassword (not someone else's password )?

Supplement:
In addition to a password box and a Password confirmation box mentioned above, I think there is a hidden box like User_id? It seems that modern browsers can modify the actual value of the hidden box, and then change the password of another person after submitting it!

You can take a closer look at the link. There is a random token parameter. Click the link. If the token does not match, the error page is displayed. If it matches, the password is changed, in addition, the token is sent to the backend along with the password, and the backend should check again. As for the token, it must exist in the background database, and the longer the token, the more secure it will be. If it is simple, you can use the uuid algorithm as the token Generation Algorithm.

The link is sent to the user's mailbox, that is, the link can be obtained only when the mailbox is entered, with this layer of security verification, it is almost guaranteed that "the person who opens the password reset link" is the person who needs to reset the password. In addition, the token in the Link can have a shorter validity period or can only be verified once, and the security level can be improved a lot.

Add the answer upstairs. The token can only be used once. More secure. If you want to increase security. You can restrict the source of the url to the email service provider corresponding to the user. In fact, it is enough to have a validity period and can only be used once.