Weak password reset in Next.js

If you implement reset yourself because you hash passwords in your own table:

• Generate the token with a cryptographic random source, at least 32 bytes, and store only a hash of it.
• Expire it in an hour or less.
• Mark it used when the password changes.
• Require the raw token to set the password. Ignore a request that only has the email.
• Rate limit both the request and the confirm route.

Do not put the token in a log, an analytics event, or a referrer to a third-party script on the reset page. That page should be simple.