title: User verification on the reset password page
body: <p>I am writing a password-reset page for my website. Here's my idea:</p>
  
  <p>a. User click the "forgot password" link on the login page</p>
  
  <p>b. Redirect to my password-reset page</p>
  
  <p>c. User enter his email address</p>
  
  <p>d. A email message sent to the email address with the link to reset his/her password. The link has security code like ?code="xxxx" in it.</p>
  
  <p>e. User open the link and enter new password, and then click the submit button.</p>
  
  <p>f. My page change user's password.</p>
  
  <p>My question is for step f. In step e, when user opened the link, I could verify his security code and then show the 'new password' and the 'confirm password' fields to user. But when the user clicked the submit button, how could I know this is a real request submited by the user instead of a hacker? Maybe I am wrong, but I think hacker can easily simulate such field data, since there is no validation fields.</p>
  
  <p>There are some idea I can think of to validate the request in step f, but I don't know whether they are right.
  1. Add a encrypted cookie in step e and check it in step f?
  2. Use a session variable in step e and check it in step f?
  3. Add a hidden field in step e and check it in step f?</p>
  
  <p>Are those approaches ok? Which one is better, or is there any better one? </p>
  
  <p>Thanks in advance.</p>