Working on some new functionality for an app, I wanted to allow the account admin to create a new user. But by creating a user you need to include a password to create the record in the database. So I quickly thought of a couple ways I could accomplish this, but they are all garbage

Let the admin set a password for each user they add

Allowing the admin to set a password for each user they create has so many downsides. Easy to guess, duplicated passwords, not forcing the user to change the password. Not to mention that only you should know your password. Unless your system forces a password reset upon first login, this should never be done.

Randomly generate a password and send it in an email

"What is this security amateur hour" I thought to myself when this popped into my head. It is never, ever, EVER acceptable to send a plain-text password in an email. But the random password is a good start. If you must send an email in plain text to someone consider using some kind of tool like 1Password to share in a secure way.

Solution: Randomly generate a password, then send a password reset email to the user.

Generating a password and encrypting it to be put into the database is easy with Laravel. Using the built in bcrypt function, it does all the work for you. So, here you will see I am checking to see if email and name are valid based on my criteria specified, then if it passes I’ll generate a new random password from my User model. Then I will add the user to the database and then send an email, passing in the user object we just made.

When it comes to the email configuration, I recommend reading the docs, since they are super rich with details. Not that it matters in this tutorial, but I am using Mailgun to test my emails out locally.

Here is the User model, there is much more to this file generally, but I am only showing the two methods that we need for this tutorial as to not be confusing. The first method it pretty straight forward, generate a random string and encrypt it using the bcrypt() function. Done.

The second method has a couple things worth pointing out. The first thing we are doing here is generating a token. This is to add a new record in the database under 'password_resets' and that token will be used in the email to associate with that record. For this to work, we need to add an alias to the config/app.

After that, we need to make sure the token is passed into the email, since it will be used in the reset link on the email. Here I am also passing in the user object, so we can get the users email and name too.

Conclusion

When creating a new user as an admin, an email will be generated after the user is added to the database. The email will have a password reset link and allow the newly created user to not only add their own password, but also have a nice welcome email letting them know they have been added to your account on the app.

Happy New Years, everyone!