java - How to create paths in RESTful web service for "action oriented" methods? -

i creating restful web service , try follow conventions , recomendations creating web service. have come halt though. have user entity in system have regular crud paths for. want expose api deal forgotten passwords. take username in request , check if finds user. if change password , change password autogenerated 1 , send email user.

i read this: restful actions/services don't correspond entity? , see maybe should start looking @ non database entities resources also.

but still have issues finding concept forgotten passwords in api.

what name path , http method appropriate it? should put used since update user new password?

i think approach has obvious weakness. think expose url generates new password user, example: post url http://mycompany.com/app/user/foobar/resetpassword

obviously url cannot password protected: otherwise use forgot password cannot reset it. ok, means knows user name can reset password of user. every 5 seconds. or milliseconds... cool!

this means have somehow protect system such "naive" hacker's attack.

i implemented similar system , can suggest solution.

1. expose open url allows start process, e.g. http://mycompany.com/app/user/foobar/resetpassword. url not change password. creates email contains yet clickable url http://mycompany.com/app/user/resetpassword/uniquetoken. token cannot guess.
2. user receives email , clicks link. time password changed , appropriate email sent same email.

this mechanism protects system naive hacker's attack , pressed "reset password" button because first action not change password. user can access email can indeed change password.

concerning token generation. best solution store mapping of token password change request in db, can limit click attempts , make request expiration timeout. implemented simpler solution reasons: token contains encrypted user name , date when password requested, implemented request expiration cannot limit number of clicks on token contained url. implementation simple , stateless.