docs: update docs for the email password reset plugin

AdminForth/1815/in-email-password-reset-we-can

Author: yaroslav8765

adminforth/documentation/docs/tutorial/09-Plugins/07-email-password-reset.md

@@ -60,6 +60,12 @@ plugins: [
     // domain part should be verified in SES
     sendFrom: 'no-reply@devforth.io',
 
+    // origin(s) of your admin panel that reset links are allowed to point to.
+    // Required: the origin is never taken from the request, so an attacker
+    // cannot make the plugin email a valid reset link to a host they control.
+    // Pass an array if the panel is served on multiple origins.
+    expectedOrigin: 'https://admin.example.com',
+
     adapter: new EmailAdapterAwsSes({
       // region where SES is setup
       region: "eu-central-1",
@@ -106,6 +112,12 @@ plugins: [
     // domain part should be verified in Mailgun
     sendFrom: 'no-reply@devforth.io',
 
+    // origin(s) of your admin panel that reset links are allowed to point to.
+    // Required: the origin is never taken from the request, so an attacker
+    // cannot make the plugin email a valid reset link to a host they control.
+    // Pass an array if the panel is served on multiple origins.
+    expectedOrigin: 'https://admin.example.com',
+
     adapter: new EmailAdapterMailgun({
       apiKey: process.env.MAILGUN_API_KEY as string,
       domain: process.env.MAILGUN_DOMAIN as string,

dev-demo/resources/adminuser.ts

@@ -199,6 +199,7 @@ export default {
       sendFrom: 'no-reply@devforth.io',
       adapter: fakeEmailAdapter,
       userResetTokensKeyValueAdapter: new KeyValueAdapterRam(),
+      expectedOrigin: process.env.RESET_PASSWORD_ORIGIN || 'http://localhost:3123',
     }),
   ],
   hooks: {