24

Lets say password reset functionality flow is the following:

  1. User submits email address used for his account.
  2. An email is sent to that email address with a link with a password reset hash.
  3. Upon clicking, a user can reset password.

I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?

2

7 Answers 7

14

There's no difference. If a hacker got to the link, then he can anyway reset the password and log in again. It makes no difference to him, he can't further abuse the feature.

The only time it makes sense to do this is if your using some form of multi factor authentication. Of course, in that case, one would expect you to include the multi factor bit in the reset workflow as well.

1
  • Accepting this answer because of the "multi factor authentication" piece that I didn't think of. Feb 18, 2013 at 19:21
19

From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral. Neither behaviour is inherently more secure than the other. I suppose that most sites do what was simplest to implement on the server side.

A point to consider is that security is achieved as long as everybody cooperates; in particular, the principle of least surprise is of paramount importance. That principle, applied to security, means that trouble is afoot when things don't occur as the human user expects it. In this case, the human user may or may not expect to be logged in after a reset. Let's see what happens if the user is "surprised":

  • If the user expected to be logged in, and is not, then he may be somewhat irked by the necessity to enter his password again. However, consequences stop there. Notably, the requirement to have to enter the password a third time will not induce the user to choose a weaker but easier to type password, because, by definition, he was not aware of this third entry when he chose the password.
  • If the user did not expect to be logged in after a password reset, and still is logged in, then that user may simply not notice that he is logged in, and remain so. This contradicts the user control of open sessions (the reason why most sites have a prominent "logout" button).

In that sense, a (rather weak) case can be made against logging the user automatically on password reset: security consequences of an unnoticed login can be worse than consequences of an unexpected lack of automatic login.

1
  • 1
    I think the impact of unintentional or 'unknown' logins are greater and thus make for a stronger than 'rather weak' case against auto-login. Logging into a service creates a venerability on the device which the user has authenticated against - for as long as that authenticated session exists, it grants any user of the device said privileges. This is why it's important that the user is explicitly aware whether they have an active session or not, and they must be sure to protect it. Having an auto-login means that the user may not know there is something to protect which is a risk IMO.
    – cottsak
    Jun 17, 2015 at 7:16
5

Anytime you are writing code you have to think to your self, "How can an attacker abuse this functionality?" Not having this internal dialog is very dangerous as the programmer will probably expose dangerous functionality. Not fully understanding the attacker's perspective will lead to looking at vulnerabilities that could never exist.

So in this case:

How could an attacker possibility benefit from automatically logging in after they have reset the password of a victims account. In this case clearly the damage is already done, and automatically logging in a user is the least of your concern.

2
  • thanks for feedback, I thought the same way as you. The reason I asked this question is that I see other websites do that and it does not make sense to me. So I thought there might be something I do not know Feb 18, 2013 at 19:16
  • Note that if you are using some form of multi factor authentication, keeping the user logged out after a password reset is better. Feb 18, 2013 at 19:17
3

It's probably just to confirm he chose the right password, what happens if you browse away from the password page on the site?

Normally when you forgot a password a one-time token is generated (often a link) which allows you to change your password and then log in.

If they immediately log you in using the one-time token after which you can change your password, it's a bit weird but not entirely less secure. After all if you can change the password, you could easily log in afterwards anyway.

The important thing is to check if, after using the token, it is invalidated. If the token allows you to change your password over and over again, then there is indeed a security issue.

2

If you change your password, all of your existing login sessions might be cleared, so that a villain who has your password gets logged out, too.

The fact that you don't get logged in immediately afterwards, or that they don't preserve your current session might just be programmer's lazyness, or what Lucas said.

4
  • Mental -1 for the first line. Invalidating the previous sessions has nothing to do with the ability to create a new session for the user after resetting the password. After all, you trusted that he's the email owner and rest the password for him based on the token, so why not log him in based on the token? Your second point, however, is correct. It could be laziness.
    – Adi
    Aug 16, 2013 at 14:30
  • @Adnan I think you and copy are pretty much saying the same thing.
    – Iszi
    Aug 16, 2013 at 14:32
  • @Iszi It's very likely that you're indeed right.
    – Adi
    Aug 16, 2013 at 14:33
  • @Adnan Yeah, I get that a lot. ;-)
    – Iszi
    Aug 16, 2013 at 15:13
1

Assuming the link does not give away any username information (which it shouldn't), and username is not user's email address (which it shouldn't be, but unfortunately sometimes is), then being able to reset "someone's" password will not be of any benefit to the attacker, unless the system automatically logs them in. Re-authentication is the preferred approach, but the risk is relative to the required security of the system.

1

The previous answers claim that from a security perspective it does not matter whether the user is being logged in automatically or not after the password-reset is completed but this really depends on how the token contained in the password-reset link is designed.

The token included in the password-reset link is necessarily comprised of two pieces of information:

  1. It needs to hold the information that it grants permission to reset the password.
  2. It needs to contain a reference or somehow be associated to the user account for which this permission is valid.

Now, how the second aspect, i.e. the "reference to the user account", is conveyed by the token actually makes a difference to whether it matters that a user is automatically logged in after password-reset or not.

Let's assume the attacker somehow intercepted the e-mail that contains the password-reset link.

If the token does not reveal any information about the associated user account, more precisely the username, and the system does not auto-login after password reset, then the attacker that has the link can only reset the password with this link but cannot gain further access to the system since the username is still not known to him/her. After resetting the password, the attacker is redirected to the login page where he/she has to enter the username which he cannot infer from just the link he/she stole – so the only damage being done here is the password being changed but no sensitive data was accessed.

In contrast, if the token contains a reference to the user account in form of a username that can be extracted by the attacker then indeed it does not matter if the system does an auto-login after password reset or not because then the attacker already knew the username (inferring it from the link) with which he/she can potentially login and gain access to the system sensitive data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .