Password Reset

Goal

This snapshot advances Marlowe Gazette by teaching you to implement expiring one-use password reset links.

Every numbered folder is complete and independently runnable, so you can inspect this stage without rebuilding earlier lessons.

Prerequisites

Use PHP 8.2 or newer, Composer, Docker, and a terminal. Basic PHP, HTML, and SQL familiarity will help.

The Laravel development server uses port 8000. Root Docker Compose exposes MySQL 8 on port 3307 and each snapshot has a separate database.

• PHP and Composer
• Docker
• A code editor and terminal

Concepts

Laravel's password broker stores token hashes, sends notifications, validates expiry, rotates the password, and clears the token.

Laravel keeps HTTP routes, controllers, Eloquent models, validation, authorization, and Blade presentation in explicit layers.

Walkthrough

Follow custom request/reset forms and controller actions around Password::sendResetLink and Password::reset.

Inspect the matching snapshot around the example. The repository includes validation, errors, CSRF protection, and the surrounding application structure.

$status = Password::sendResetLink($request->only('email'));

Run and verify

Start MySQL from the repository root, enter 11-Password-Reset, install dependencies, copy the environment file, generate an application key, migrate, seed, and serve.

Open http://localhost:8000. From data lessons onward, Ada and Grace are deterministic accounts with password password123.

docker compose up -d
git clone https://github.com/michaeldunga1/fcc-laravel-blog.git
cd fcc-laravel-blog/11-Password-Reset
composer install
cp .env.example .env
php artisan key:generate
php artisan migrate --seed
php artisan storage:link
php artisan serve --host=0.0.0.0 --port=8000

Troubleshooting

With the log mailer, inspect storage/logs/laravel.log; in production configure a real SMTP provider.

If MySQL fails, verify Docker is healthy, port 3307 is free, and this snapshot's DB_DATABASE matches its unique marlowe_XX database.

• Read the first exception
• Clear cached config after environment changes
• Never commit .env, vendor, or node_modules

Try this

Request a link, reset once, then verify the same token cannot be reused.

Exercise both a successful request and a validation or authorization failure before moving to the next snapshot.

• Make one focused change
• Test it in the browser
• Compare the next snapshot after it works