Lets say password reset functionality flow is the following:
- User submits email address used for his account.
- An email is sent to that email address with a link with a password reset hash.
- Upon clicking, a user can reset password.
I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?