diff --git a/.vs/SecureCore/v16/.suo b/.vs/SecureCore/v16/.suo
index 5a982d6..d785088 100644
Binary files a/.vs/SecureCore/v16/.suo and b/.vs/SecureCore/v16/.suo differ
diff --git a/SecureCore/Controllers/AuthController.cs b/SecureCore/Controllers/AuthController.cs
index 44cb7c7..478974c 100644
--- a/SecureCore/Controllers/AuthController.cs
+++ b/SecureCore/Controllers/AuthController.cs
@@ -89,6 +89,8 @@ namespace SecureCore.Controllers
         //[AcceptVerbs("GET")]
         public IActionResult ResetPassword([FromQuery] string token)
         {
+            if (!UserDataService.IsResetTokenValid(token)) return Unauthorized("Token invalid");
+
             return Ok("Done");
         }
 
@@ -105,7 +107,9 @@ namespace SecureCore.Controllers
             {
                 UserDataService.SetUserSessionToken(userName, token, DateTime.Now.AddHours(1), agent, ip, true);
 
-                return Ok($"192.168.255.200:5000/auth/ResetPassword?{token}{Environment.NewLine}");
+                token = HttpUtility.UrlEncode(token);
+
+                return Ok($"192.168.255.200:5000/auth/ResetPassword?token={token}{Environment.NewLine}");
             }
             catch(Exception e)
             {
diff --git a/SecureCore/Services/UserDataService.cs b/SecureCore/Services/UserDataService.cs
index f2f37a7..8e15c01 100644
--- a/SecureCore/Services/UserDataService.cs
+++ b/SecureCore/Services/UserDataService.cs
@@ -160,6 +160,23 @@ namespace SecureCore.Services
             }
         }
 
+        public static bool IsResetTokenValid(string token)
+        {
+            using (var connection = new SqlConnection(ConnectionString))
+            {
+                using (var command = new SqlCommand("ValidateResetToken", connection) { CommandType = CommandType.StoredProcedure })
+                {
+                    command.Parameters.AddWithValue("SessionToken", token);
+
+                    connection.Open();
+
+                    var reader = command.ExecuteScalar();
+
+                    return Convert.ToBoolean(reader);
+                }
+            }
+        }
+
         //public static void ResetPassword(string email)
         //{
         //    using (var connection = new SqlConnection(ConnectionString))