Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Lets say password reset functionality flow is the following:

  1. User submits email address used for his account.
  2. An email is sent to that email address with a link with a password reset hash.
  3. Upon clicking, a user can reset password.

I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

There's no difference. If a hacker got to the link, then he can anyway reset the password and log in again. It makes no difference to him, he can't further abuse the feature.

The only time it makes sense to do this is if your using some form of multi factor authentication. Of course, in that case, one would expect you to include the multi factor bit in the reset workflow as well.

share|improve this answer
    
Accepting this answer because of the "multi factor authentication" piece that I didn't think of. –  Dmitry Feb 18 '13 at 19:21

Anytime you are writing code you have to think to your self, "How can an attacker abuse this functionality?" Not having this internal dialog is very dangerous as the programmer will probably expose dangerous functionality. Not fully understanding the attacker's perspective will lead to looking at vulnerabilities that could never exist.

So in this case:

How could an attacker possibility benefit from automatically logging in after they have reset the password of a victims account. In this case clearly the damage is already done, and automatically logging in a user is the least of your concern.

share|improve this answer
    
thanks for feedback, I thought the same way as you. The reason I asked this question is that I see other websites do that and it does not make sense to me. So I thought there might be something I do not know –  Dmitry Feb 18 '13 at 19:16
    
Note that if you are using some form of multi factor authentication, keeping the user logged out after a password reset is better. –  Manishearth Feb 18 '13 at 19:17

Assuming the link does not give away any username information (which it shouldn't), and username is not user's email address (which it shouldn't be, but unfortunately sometimes is), then being able to reset "someone's" password will not be of any benefit to the attacker, unless the system automatically logs them in. Re-authentication is the preferred approach, but the risk is relative to the required security of the system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.