src/Auth.php
public function forgotPassword($email, callable $callback, $requestExpiresAfter = null, $maxOpenRequests = null) {
		$email = self::validateEmailAddress($email);

		$this->throttle([ 'enumerateUsers', $this->getIpAddress() ], 1, (60 * 60), 75);

		if ($requestExpiresAfter === null) {
			// use six hours as the default
			$requestExpiresAfter = 60 * 60 * 6;
		}
		else {
			$requestExpiresAfter = (int) $requestExpiresAfter;
		}

		if ($maxOpenRequests === null) {
			// use two requests per user as the default
			$maxOpenRequests = 2;
		}
		else {
			$maxOpenRequests = (int) $maxOpenRequests;
		}

		$userData = $this->getUserDataByEmailAddress(
			$email,
			[ 'id', 'verified', 'resettable' ]
		);

		// ensure that the account has been verified before initiating a password reset
		if ((int) $userData['verified'] !== 1) {
			throw new EmailNotVerifiedException();
		}

		// do not allow a password reset if the user has explicitly disabled this feature
		if ((int) $userData['resettable'] !== 1) {
			throw new ResetDisabledException();
		}

		$openRequests = (int) $this->getOpenPasswordResetRequests($userData['id']);

		if ($openRequests < $maxOpenRequests) {
			$this->throttle([ 'requestPasswordReset', $this->getIpAddress() ], 4, (60 * 60 * 24 * 7), 2);
			$this->throttle([ 'requestPasswordReset', 'user', $userData['id'] ], 4, (60 * 60 * 24 * 7), 2);

			$this->createPasswordResetRequest($userData['id'], $requestExpiresAfter, $callback);
		}
		else {
			throw new TooManyRequestsException('', $requestExpiresAfter);
		}
	}
public function forgotPassword($email, callable $callback, $requestExpiresAfter = null, $maxOpenRequests = null) {
		$email = self::validateEmailAddress($email);

		$this->throttle([ 'enumerateUsers', $this->getIpAddress() ], 1, (60 * 60), 75);

		if ($requestExpiresAfter === null) {
			// use six hours as the default
			$requestExpiresAfter = 60 * 60 * 6;
		}
		else {
			$requestExpiresAfter = (int) $requestExpiresAfter;
		}

		if ($maxOpenRequests === null) {
			// use two requests per user as the default
			$maxOpenRequests = 2;
		}
		else {
			$maxOpenRequests = (int) $maxOpenRequests;
		}

		$userData = $this->getUserDataByEmailAddress(
			$email,
			[ 'id', 'verified', 'resettable' ]
		);

		// ensure that the account has been verified before initiating a password reset
		if ((int) $userData['verified'] !== 1) {
			throw new EmailNotVerifiedException();
		}

		// do not allow a password reset if the user has explicitly disabled this feature
		if ((int) $userData['resettable'] !== 1) {
			throw new ResetDisabledException();
		}

		$openRequests = (int) $this->getOpenPasswordResetRequests($userData['id']);

		if ($openRequests < $maxOpenRequests) {
			$this->throttle([ 'requestPasswordReset', $this->getIpAddress() ], 4, (60 * 60 * 24 * 7), 2);
			$this->throttle([ 'requestPasswordReset', 'user', $userData['id'] ], 4, (60 * 60 * 24 * 7), 2);

			$this->createPasswordResetRequest($userData['id'], $requestExpiresAfter, $callback);
		}
		else {
			throw new TooManyRequestsException('', $requestExpiresAfter);
		}
	}
public function forgotPassword ( $ email , callable $ callback , $ requestExpiresAfter = null , $ maxOpenRequests = null ) { $ email = self :: validateEmailAddress ( $ email ) ; $ this -> throttle ( [ 'enumerateUsers' , $ this -> getIpAddress ( ) ] , 1 , ( 60 * 60 ) , 75 ) ; if ( $ requestExpiresAfter === null ) { // use six hours as the default $ requestExpiresAfter = 60 * 60 * 6 ; } else { $ requestExpiresAfter = ( int ) $ requestExpiresAfter ; } if ( $ maxOpenRequests === null ) { // use two requests per user as the default $ maxOpenRequests = 2 ; } else { $ maxOpenRequests = ( int ) $ maxOpenRequests ; } $ userData = $ this -> getUserDataByEmailAddress ( $ email , [ 'id' , 'verified' , 'resettable' ] ) ; // ensure that the account has been verified before initiating a password reset if ( ( int ) $ userData [ 'verified' ] !== 1 ) { throw new EmailNotVerifiedException ( ) ; } // do not allow a password reset if the user has explicitly disabled this feature if ( ( int ) $ userData [ 'resettable' ] !== 1 ) { throw new ResetDisabledException ( ) ; } $ openRequests = ( int ) $ this -> getOpenPasswordResetRequests ( $ userData [ 'id' ] ) ; if ( $ openRequests < $ maxOpenRequests ) { $ this -> throttle ( [ 'requestPasswordReset' , $ this -> getIpAddress ( ) ] , 4 , ( 60 * 60 * 24 * 7 ) , 2 ) ; $ this -> throttle ( [ 'requestPasswordReset' , 'user' , $ userData [ 'id' ] ] , 4 , ( 60 * 60 * 24 * 7 ) , 2 ) ; $ this -> createPasswordResetRequest ( $ userData [ 'id' ] , $ requestExpiresAfter , $ callback ) ; } else { throw new TooManyRequestsException ( '' , $ requestExpiresAfter ) ; } }
Initiates a password reset request for the user with the specified email address

The callback function must have the following signature:

`function ($selector, $token)`

Both pieces of information must be sent to the user, usually embedded in a link

When the user wants to proceed to the second step of the password reset, both pieces will be required again

@param string $email the email address of the user who wants to request the password reset
@param callable $callback the function that sends the password reset information to the user
@param int|null $requestExpiresAfter (optional) the interval in seconds after which the request should expire
@param int|null $maxOpenRequests (optional) the maximum number of unexpired and unused requests per user
@throws InvalidEmailException if the email address was invalid or could not be found
@throws EmailNotVerifiedException if the email address has not been verified yet via confirmation email
@throws ResetDisabledException if the user has explicitly disabled password resets for their account
@throws TooManyRequestsException if the number of allowed attempts/requests has been exceeded
@throws AuthError if an internal problem occurred (do *not* catch)
Initiates a password reset request for the user with the specified email address