How to Build a Secure Password Reset Flow: Tokens, States, and Session Revocation

·4 views

A secure password recovery system should return identical responses for both known and unknown email addresses to prevent account enumeration, a practice recommended by OWASP. The reset flow relies on a single-use, short-lived token that is hashed before storage and consumed in one atomic transaction upon use. A five-state model — requested, delivered, confirmed, completed, and expired — keeps the process auditable and makes retry handling predictable. Once a password change is confirmed, all active sessions for that account are immediately revoked to prevent unauthorized access. For teams migrating away from managed auth providers, the article recommends keeping this state machine in the application database behind replaceable repository and mailer interfaces.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Adds Play Books Integration to Gemini Notebook for Source-Grounded AI Outputs

Google has expanded Gemini Notebook with a feature called Expert Intelligence, which allows users to use eligible ebooks they own through Google Play Books as grounded source material for AI interactions. The update enables Gemini Notebook to generate outputs such as answers, infographics, audio overviews, and quizzes by combining a user's owned books with their own documents. The initial catalog covers over 100,000 titles from major publishers, and the feature is described as a cross-Google effort developed in collaboration with authors and publishers. A key limitation applies to shared notebooks: collaborators must independently own the relevant book to engage with its content, meaning a single purchase cannot be extended to an entire team. Google plans to expand Expert Intelligence to additional sources and platforms, including the Gemini app and AI Mode in Search, over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

87% of Custom Claude Code Agents Went Unused for 30 Days, Wasting Tokens

A developer running an automated Claude Code setup discovered that seven of their eight custom-defined agents recorded zero invocations over a 30-day period from late May to August 2026. Only the code-reviewer agent was called even once, while specialists like architect, security-reviewer, and database-reviewer sat completely idle. The problem is structural: Claude Code injects all agent definitions into the system prompt on every request, meaning unused agents silently consume tokens and can degrade inference quality. Claude does not autonomously select agents based on their own descriptions — an agent only activates when explicitly invoked by a calling prompt or logic. The developer's takeaway is that agent utility should be measured through actual usage logs, not assumptions, and that unused definitions should be pruned regularly to reduce both token costs and management complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

EKS, ECS, or Fargate: How to Pick the Right AWS Container Setup

AWS offers two container orchestrators — ECS and EKS — each combinable with either EC2 or Fargate as the underlying compute, making these separate decisions that are often confused. ECS is AWS's simpler, cost-free control-plane option suited for small teams and AWS-only workloads, while EKS provides managed Kubernetes with a richer ecosystem but higher operational overhead. Fargate eliminates node management and suits variable or bursty workloads, whereas EC2 is more cost-effective for steady, high-volume or GPU-dependent tasks. For most teams running fewer than 20 services on AWS alone, ECS on Fargate is recommended as the practical default. EKS is better justified when Kubernetes expertise, multi-cloud portability, or a large service footprint makes the added complexity worthwhile.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NotebookLM Short and Cinematic Video Overviews Limited to English Only

Google's NotebookLM platform offers multiple video overview formats, but its Short Video Overview and Cinematic Video Overview features currently support only English, according to official product documentation. The Short Video Overview generates roughly 60-second vertical videos from notebook sources, making it suitable for English-language internal briefings or quick content recaps. Businesses requiring multilingual video output should instead use the Explainer Video Overview format, which Google documents as supporting a broader range of languages. The distinction is critical for teams building content workflows around NotebookLM for education, internal communication, or customer-facing material. Google's expanded language support across some NotebookLM formats does not apply uniformly, so users are advised to verify language availability for each specific format before production.

0 comments Read more at DEV Community