--- title: Forgot Password using Node JS with Knex and Express description: This post provides a detailed analysis of how to implement a forgot password flow using Node.js, Knex, and Express. It covers topics such as handling URL... canonical: https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Forgot Password using Node JS with Knex and Express | daily.dev og:description: This post provides a detailed analysis of how to implement a forgot password flow using Node.js, Knex, and Express. It covers topics such as handling URL... og:url: https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh og:image: https://api.daily.dev/og/posts/igjc2mlXh.png og:image:alt: Forgot Password using Node JS with Knex and Express og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Forgot Password using Node JS with Knex and Express **[ITNEXT](https://daily.dev/sources/itnext)** · 6 min read · 10 upvotes · 1 comments ## Summary This post provides a detailed analysis of how to implement a forgot password flow using Node.js, Knex, and Express. It covers topics such as handling URL parameters, managing email submissions, and addressing security concerns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@codectl** · 0 upvotes > Preventing user/account enumeration can be an important security measure and in some cases is required for compliance purposes. Happy to see it implemented properly in this article but could be called out more explicitly. > > Essentially, in either case of finding the user or not, the response from the server MUST be ambiguous to not give away information about whether the user exists. > Another thing to consider is timing attacks and ability to perform account enumeration. This could be mitigated with random delays. > > Lastly, consider using some form of rate limiting to prevent abuse on these... ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#express](https://daily.dev/tags/express) [View this post on daily.dev](https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Forgot Password using Node JS with Knex and Express","url":"https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh"},"datePublished":"2024-03-28T08:09:41.977Z","dateModified":"2024-05-09T08:22:04.995Z","description":"This post provides a detailed analysis of how to implement a forgot password flow using Node.js, Knex, and Express. It covers topics such as handling URL...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/885c736196730d0a2051b969837da06f?_a=AQAEufR","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/885c736196730d0a2051b969837da06f?_a=AQAEufR","isAccessibleForFree":true,"articleSection":"ITNEXT","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ITNEXT","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2","url":"https://daily.dev/sources/itnext"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"nodejs,express","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ITNEXT","item":"https://daily.dev/sources/itnext"},{"@type":"ListItem","position":3,"name":"Forgot Password using Node JS with Knex and Express"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/forgot-password-using-node-js-with-knex-and-express-igjc2mlxh","comment":[{"@type":"Comment","text":"Preventing user/account enumeration can be an important security measure and in some cases is required for compliance purposes. Happy to see it implemented properly in this article but could be called out more explicitly.\nEssentially, in either case of finding the user or not, the response from the server MUST be ambiguous to not give away information about whether the user exists.\nAnother thing to consider is timing attacks and ability to perform account enumeration. This could be mitigated with random delays.\nLastly, consider using some form of rate limiting to prevent abuse on these sensitive endpoints.\nhttps://arc.net/l/quote/josbaali\nhttps://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account\nhttps://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/10-Business_Logic_Testing/04-Test_for_Process_Timing","datePublished":"2024-04-03T16:34:28.160Z","url":"https://daily.dev/posts/igjc2mlXh#c-me0LMDF37","author":{"@type":"Person","name":"dillon","url":"https://daily.dev/codectl","image":"https://avatars.githubusercontent.com/u/26043866?v=4"}}]} ```