Laravel sends password reset links and email verification messages through a configured mailer. For local development, use a mail testing service or another suitable development mail setup.

Example SMTP settings in .env:

MAIL_MAILER=smtp
MAIL_HOST=smtp.example.com
MAIL_PORT=587
MAIL_USERNAME=your_username
MAIL_PASSWORD=your_password
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS="noreply@example.com"
MAIL_FROM_NAME="${APP_NAME}"

Replace the example host, username, password, and sender address with values supplied by your email provider.

Keep real email credentials private. Never commit production mail passwords to a public repository.

After changing environment configuration, clear cached configuration when necessary:

php artisan config:clear

Email delivery must be configured correctly for password reset and verification emails to reach users.

The password broker validates the reset token, confirms the associated user, and updates the password when the reset is successful.

Add a method to PasswordResetController:

use App\Models\User;
use Illuminate\Auth\Events\PasswordReset;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Str;
use Illuminate\Validation\Rules\Password as PasswordRule;

public function resetPassword(Request $request)
{
    $validated = $request->validate([
        'token' => ['required'],
        'email' => ['required', 'email'],
        'password' => [
            'required',
            'confirmed',
            PasswordRule::min(8),
        ],
    ]);

    $status = Password::reset(
        $validated,
        function (User $user, string $password) {
            $user->forceFill([
                'password' => Hash::make($password),
            ])->setRememberToken(Str::random(60));

            $user->save();

            event(new PasswordReset($user));
        }
    );

    if ($status === Password::PASSWORD_RESET) {
        return redirect()
            ->route('login')
            ->with('status', __($status));
    }

    return back()
        ->withErrors(['email' => __($status)]);
}

Register the reset form routes:

Route::middleware('guest')->group(function () {
    Route::get(
        '/reset-password/{token}',
        function (\Illuminate\Http\Request $request, string $token) {
            return view('auth.reset-password', [
                'token' => $token,
                'email' => $request->query('email', ''),
            ]);
        }
    )->name('password.reset');

    Route::post(
        '/reset-password',
        [PasswordResetController::class, 'resetPassword']
    )->name('password.update');
});

Add these routes inside the existing guest route group or merge them into it. Do not duplicate route names already supplied by an authentication starter kit.

The forceFill() call updates protected model attributes. The password broker checks the token and its validity before invoking the callback.