title: Implementing forgot password functionality in Java
body: <p>I am currently implementing a forgot password function in a Java project. my methodology is,</p>
  
  <ol>
  <li>User clicks the forgot password link.</li>
  <li>In the forgot password page, system prompts the user to enter the email address he/she has registered in to the system.</li>
  <li>An email which contains a link to reset the password is sent to the given email address in step above.</li>
  <li>User clicks the link and he/she get redirected to a page(reset password) where user can enter his new password.</li>
  <li>In Reset Password page, the field "email address" is filled automatically and it cannot be changed.</li>
  <li>Then user enter his new password and the field related to the email address in the database is updated.</li>
  </ol>
  
  <p>Although I have restricted the <code>email address</code> field in the reset password page from editing (a read only field) any one can alter the url in the address bar of the browser and change the email address field.</p>
  
  <p>How Do I restrict every user from altering the email address in the reset password page?</p>