Using Java,

Add a Reset Password link to the Login Page.

Create a password_reset.jsp

Using EL, bind the User object password to a form field in a page.

Allow the user to change their password.

On the servlet side, retrieve the user from the session and change the password to the password entered on the reset form.

Save the User object in session scope.

Redirect the user to the account_activity page