...
- Creates a token with a short lifespan (2 10 minutes).
- Creates an entry in a PasswordResetRequest table associating the token and the email of the user that is initiating the request. This association prevents any valid token (other than the one that was specifically created for this purpose) to reset a user's password and/or pin.
- Optionally emails the user a link that can be used to reset his/her password. (the link contains the generated token and the email of the user)
...