how about ask the user to enter their username to change password, then send an email to the email with a link to password change screen

yes i did this, now the user enter his user name, and i send him the link. the issue now that when i get to the reset password form with the token, i can change password to each username i like and not just the user that i send the reset password with.

instead of email i change the input to username, but still i am facing this last issue. this is the files that i change every input email to username. in this file CanResetPassword i added new method to get the username.

 public function getUserNameForPasswordReset()
    {
        return $this->username;
    }

vendor/laravel/framework/src/Illuminate/Auth/Passwords/CanResetPassword.php vendor/laravel/framework/src/Illuminate/Foundation/Auth/ResetsPasswords.php vendor/laravel/framework/src/Illuminate/Foundation/Auth/SendsPasswordResetEmails.php