Best practice for resetting forgotten user passwords

Question

As far as I can think, there are two reasonable ways to reset a user\'s forgotten password.

1. Have the user enter their email address and a new plaintext pass

Answer 1

The best pattern would be :

1. User requests password reset. Best is to do it through username, and don't indicate if the username exists or not (to avoid possible users listing through a script)

2. You generate a record in a new database table with userid, datetime of request (= current datetime), and a GUID you just generated

3. You send a mail to the user, pointing to password reset page with the GUID (not the userid) as parameter

4. On this page, you should check that the GUID is existing, and eventually you could put some expiration date (=the user has 1 day to reset, for example)

5. Don't forget to mark the record as "used" (with an extra field in the table) when the user reset his password, so that you can stop an eventual second try...

It could possibly even more secure, but that is already quite good I think....