I am trying to perform forgot password operation, i.e. trying to send a mail to the user to change the password via a reset password link contained in the mail. I am using .env file to store my username, passwords, and added it to gitigonre.

javascript post code:-

app.post("/forgot", function (req, res, next) {
  async.waterfall(
    [
      function (done) {
        crypto.randomBytes(20, function (err, buf) {
          var token = buf.toString("hex");
          done(err, token);
        });
      },
      function (token, done) {
        User.findOne({ email: req.body.email }, function (err, user) {
          if (!user) {
            req.flash("error", "No account with that email address exists.");
            return res.redirect("/forgot");
          }
          // app.get('/reset');
          user.resetPasswordToken = token;
          user.resetPasswordExpires = Date.now() + 3600000; // 1 hour

          user.save(function (err) {
            done(err, token, user);
          });
        });
      },
      function (token, user, done) {
        var smtpTransport = nodemailer.createTransport({
          host: "smtp.gmail.com",
          service: "gmail",
          auth: {
            xoauth2: xoauth2.createXOAuth2Generator({
              type: "OAuth2",
              user: process.env.Gmail_username,
              clientSecret: process.env.Gmail_password,
            }),
          },
          tls: {
            ciphers: "SSLv3",
          },
        });
        var mailOptions = {
          from: "passwordreset@demo.com",
          to: user.email,
          subject: "Node.js Password Reset",
          text:
            "You are receiving this because you (or someone else) have requested the reset of the password for your account.\n\n" +
            "Please click on the following link, or paste this into your browser to complete the process:\n\n" +
            "http://" +
            req.headers.host +
            "/reset/" +
            token +
            "\n\n" +
            "If you did not request this, please ignore this email and your password will remain unchanged.\n",
        };
        smtpTransport.sendMail(mailOptions, function (err) {
          req.flash(
            "info",
            "An e-mail has been sent to " +
              user.email +
              " with further instructions."
          );
          done(err, "done");
        });
      },
    ],
    function (err) {
      if (err) return next(err);
      res.redirect("/forgot");
    }
  );
});

I have allowed access for the less secure apps for the email address too. Client secret key is as generated by google account, it's not the password of my gmail account, just named after that. Can someone suggest, what I am doing wrong..