Password reset tokens are time-limited and single-use

A non-expiring or reusable password reset token is a persistent account takeover vector: intercept it once (from a forwarded email, a shared device, or a log entry), and you can reset the password at any time in the future. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) and CWE-262 (Not Using Password Aging) both apply. OWASP ASVS V2.5 requires that recovery tokens be short-lived, high-entropy, and single-use; OWASP A07 (Identification and Authentication Failures) lists broken account recovery as a named failure mode.

Store a hash of the token, set a 1-hour expiry, and mark it used atomically on consumption — all three conditions must hold:

// Generation — store hash, send raw token in the email link
const rawToken = crypto.randomBytes(32).toString('hex')
const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex')
await db.passwordReset.create({
  data: { tokenHash, userId, expiresAt: new Date(Date.now() + 3600_000), usedAt: null }
})

// Consumption — validate, check expiry, mark used in one query
const record = await db.passwordReset.findFirst({
  where: { tokenHash, usedAt: null, expiresAt: { gt: new Date() } }
})
if (!record) return error('Invalid or expired token')
await db.passwordReset.update({ where: { id: record.id }, data: { usedAt: new Date() } })

The raw token goes in the email link; the hash goes in the database. A leaked database row does not compromise the reset link.