Background
I'm planning to implement a password reset function in my application. After some research, I've evaluated this approach to fit my needs:
- User enters a "Reset Password" Activity where he enters a pre-registered email to be send a reset link.
- The system has a table
password_change_requests
with the columnsID
,Time
andUserID
. When the user presses the "send" button to reset the password, a record is created in the table. TheTime
column contains the time when the user pressed the "Forgot Password" button. TheID
is a string. A long random string is created and then hashed like a password. This hash is then used as the 'ID' in the table. - The system sends an email to the user which contains a link in it. The link also contains the original ID string (before the hashing).
- When the user clicks the link in the email, he is moved to the application in question. The app retrieves the ID from the URL, hashes it again, and checks against the table. If such a record is there and is no more than, say, 24 hours old, the user is presented with the prompt to enter a new password.
- The user enters a new password, hits OK.
This approach was inspired by the answer to this question by Vilx-.
The difficulties
At first glance, the above presented approach seemed to be easy enough to implement. But I've ran into some headaches. Step (1) and (2) are easily implemented. When I had a closer look step (3) and (4) my initial thought was to send some kind of Intent
with the email, since that's the usual way to launch applications. But since the "source" of the intent would be HTML code at best, I'm not quite sure if that will work.
Questions
- How can I launch my specific android application from an email (say an HTML anchor tag) in the users inbox?
- How do I pass on the data (the ID string) to my application via the email?
And if this is not possible, is there an alternative way to solve the above approach?