Logging in a user after password reset via link

Question

Lets say password reset functionality flow is the following:

1. User submits email address used for his account.
2. An email is sent to that email address with a link with a password reset hash.
3. Upon clicking, a user can reset password.

---

I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?

Answer 1

There's no difference. If a hacker got to the link, then he can anyway reset the password and log in again. It makes no difference to him, he can't further abuse the feature.

The only time it makes sense to do this is if your using some form of multi factor authentication. Of course, in that case, one would expect you to include the multi factor bit in the reset workflow as well.

Answer 2

Anytime you are writing code you have to think to your self, "How can an attacker abuse this functionality?" Not having this internal dialog is very dangerous as the programmer will probably expose dangerous functionality. Not fully understanding the attacker's perspective will lead to looking at vulnerabilities that could never exist.

So in this case:

How could an attacker possibility benefit from automatically logging in after they have reset the password of a victims account. In this case clearly the damage is already done, and automatically logging in a user is the least of your concern.