pythondjangodjango-rest-frameworkdjango-viewsforgot-password

How to implement OTP based verification before letting the user to create a new password using pyotp?


I am very new to Django rest framework. I am building APIs for my mobile application. In forgot password module, I have the below flow

  1. Ask user to enter mobile
  2. check existence
  3. If exists - > send OTP
  4. Verify and let user create a new password.

But in this case, I would like to know the way of handle the below situation.

When one user requests otp and waiting for it to verify, meanwhile another user requests for OTP At this time, how to handle the both users? I thought of

  1. creating the dictionary and save the user id as key and otp as value in views.py to verify particular user.
  2. store the otp temporarily until it verifies.

Which is the secured way and any alternative for this kind of scenario?


Solution

  • You should create a table look like this:

    ===== UserOTP =====
    user: foreign-key to user
    code: CharField, random generated code here (or token)
    create_date: auto-fill created datetime
    used_date: nullable datetime field
    

    Then on each password reset request create a row on this table, send generated code to user via SMS or Email,

    And then on another end-point receive the code from user and check it (for expiration and used before, belongs to this user and etc.) then continue password reset process.