title: what is the best practice for forgot password process?
body: <p>I am currently developing a c# web application that allows users to login with a password. A feature that I need to include is a forgot password function.</p>
  
  <p>What is the recommended process for forgot password?</p>
  
  <p>I was considering this:</p>
  
  <ul>
  <li>User clicks forgot password, enter email address</li>
  <li>Email sent</li>
  <li>Click on link in email (link only valid once and within time period)</li>
  <li>Taken to the site and asked to enter new password (should they also give answer to security question?)</li>
  <li>Password changed, email sent to user of such</li>
  <li>User now can log in with new password</li>
  </ul>