Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the URL so during the password reset process I can use that ID to fetch their secret questions, their token, and to reset their PW's.

I am aware of validation of the URL string as only these characters are allowed in the URL bar :

'a-z 0-9_-'

also I am aware of encoding and escaping as when I query the DB and append the users ID I run it through urlencode and when I put it into query I run urldecode to get it back to its most natural value (the db value) that I first queried before appending it the URL.

Am I missing anything? I guess one of my fears is what happens if someone enters in another users ID for possibly trying to DOS another user? Keeping in mind I only append the user ID after the user has clicked on the email verification link. Am I going about this correctly?

Any clarifications would be very nice. Thanks in advance.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

You are going about it all wrong. Why will you need to send the USER_ID over a GET request to retrieve the secret questions and tokens like you mentioned?

You probably store the reset tokens in a table in the database with a foreign key linking it to the user's data stored in another table. You can simply parse the token sent using GET and retrieve all the information you need about the user.

Also, the way you describe your process isn't very clear. You should ask the user to input the secret question before sending out the password reset link. There is no point in doing it the other way around and not requiring any validation to trigger a password reset can be very annoying for a user if he gets endless password reset request.

share|improve this answer
    
Doing research on this subject it seems that it is better to verify that the user has access to the email / phone and then ask for the questions. These statements are based on these links : lh5.ggpht.com/-ke9GVduXaaY/T7rBCWHFkYI/AAAAAAAADmY/xvEOczv44Zg/… and this link : stackoverflow.com/questions/3164978/… –  Rixhers Ajazi Aug 25 '13 at 4:34
    
@RixhersAjazi Why exactly is it better? –  Terry Chia Aug 25 '13 at 4:40
    
If we ask for the answers first then we 1) Wouldn't be able to verify if its "a human" 2) the attacker could possibly get the answers to the questions via social engineering 3) if your at a college campus (like I am, this program is a scholarship management tool) emails are widely available, so the attacker could do a reset process for a professor, then have time to talk about the answers / look social engineer said answers which is also back to step 2 –  Rixhers Ajazi Aug 25 '13 at 4:46
    
Asking for email first, reCaptcha the user, then send a link we can have some sort of "security in depth". In the end if the email is compromised then its all over anyways. –  Rixhers Ajazi Aug 25 '13 at 4:47
    
@RixhersAjazi So what is stopping you from requiring both the recaptcha and the secret password to trigger a password reset? Either way I have to compromise the email account to do any significant damage. Why can't I social engineer the answers before triggering the password reset process? –  Terry Chia Aug 25 '13 at 4:55
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.