Golang Microservices Full Course #17 - Forgot Password & Reset Password

Summary

The episode implements a password-recovery flow for a Go wallet application, reusing the OTP infrastructure built for email verification in the previous episode. The endpoints are public, so users do not need to be authenticated to request or complete a password reset.

Main ideas and implementation steps

• Protect account privacy: The forgot-password endpoint always returns a generic success message, such as “If the email is registered, you will receive a code.” This avoids revealing whether an email address exists in the database.
• Generate and send a reset OTP:
  • Look up the account associated with the submitted email.
  • If an account exists, generate a six-digit OTP using cryptographically secure randomness.
  • Save the OTP with a password-reset type and send it using the existing email infrastructure.
• Verify the reset request: The user submits their email and OTP. The service checks that the code is valid and active, then returns the relevant user ID for the reset operation. Invalid or expired codes are rejected.
• Validate the new password: The reset request includes a new password and confirmation. The handler checks that they match and returns a validation error if they do not.
• Store the password securely: The service hashes the new password with bcrypt and updates the user’s password hash in the database. In the flow described, the reset endpoint does not require the OTP again after verification succeeds.
• Reuse and extend existing components: The implementation builds on the previous episode’s OTP model, repository, database migration, SMTP configuration, email helper, and expired-OTP cleanup process. OTP generation is generalized to support multiple purposes, including email verification and password reset.
• Test the flow: The presenter tests the endpoints with Postman and checks email delivery with MailHog. Demonstrated checks include invalid OTPs, mismatched password confirmation, and a successful password reset. The presenter also verifies that OTP cleanup remains active.

Speakers and sources featured

• Speaker: The video’s presenter and instructor, who walks through the implementation.
• Referenced project sources and tools: The preceding email-verification episode and its OTP infrastructure; the Go application’s user service, handlers, repositories, and database migration; Postman and MailHog for manual testing; and a coding assistant prompted to review the changes and add tests and documentation.