Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter the new password. So far so good. But at this point, they always prompt me to login again. Why? I just entered my password twice along with my login (email - of course this is done implicitly via the link). So why prompt me to login again? Is there a security reason for this that I am not seeing? Or is it just an old practice that seems to linger?

share|improve this question

5 Answers 5

There is no reason this cannot be done technically, and I see the occasional site doing it. But it would require extra code to be built, so it's cheaper to let you handle the login ;-)

The same thing happens with the confirmation link when registering: in most cases you still have to login (but in this case there are relatively more sites that auto-login, in my experience).

share|improve this answer
1  
The confirmation link is a very different story. If a person only knows the confirmation token but not the password, you certainly do not want to give them access to the account. They could have gotten the token through social engineering, intercepting this one e-mail or whatever. This is not sufficient proof of ownership. –  Fleche Aug 7 at 9:00
    
It annoys me too - it's just lazy practice. It's also sometimes indicative of an unstructured application as it suggests it's not easy to trigger a login from a page other than the login page perhaps due to poor code encapsulation / re-use. But most often just lazy... –  Andy Boura Aug 7 at 9:07

This behaviour does indicate one good security practice: all sessions are invalidated on change password.

Perhaps the user is changing password because the old one has been compromised. In that case, invalidating all sessions helps protect the user.

It is true that there is no real need to invalidate the session that performed the password reset. But a website requiring a re-login tends to imply they are following good security practice, while websites that do not do this tend not to invalidate sessions at all.

share|improve this answer
1  
I don't entirely agree, good practice would be to end old session and create a new one for the user...it suggests to me the application code is not structured in a way that easily allows this. –  Andy Boura Aug 7 at 10:17
    
@AndyBoura - yes, that is the best approach. However, it is not the most common approach. –  paj28 Aug 7 at 13:10
    
The question has nothing to do with whether or not old sessions are invalidated. The OP wanted to know why some applications don't automatically start a new session after the password has been changed. Session invalidation is another story. –  Fleche Aug 7 at 13:17
    
@Fleche - the question does not mention a new session. He wanted to know if there was a security reason the logout happens and I explained it. We all know the app can be designed not to do this, but as the OP says, many are not. Not impressed that you and Andy are laying into me for answering the question, but I'm learning not to expect anything else from the SE community. –  paj28 Aug 7 at 13:24
    
Not sure what you're reading into the question. The OP didn't say anything about being logged out. He asked why he has to enter the password again into the log-in form when he has just entered it into the password reset form. He may or may not have had an old session which was terminated in the procedure, but that's simply not the question. In fact, it seems a bit odd to forget the password while you're logged in (which is not to say that it doesn't happen). –  Fleche Aug 7 at 13:56

I'm not 100% sure, but, after you clicked that password reset link, of course your password is changed, which means you cannot login with that credentials that have been provided with that link or password whatever it was. The credentials which had been logged you into that website somehow are expired. And after you successfully change your password, you can login with full privileges of your account/ profile. Just my opinion,though

share|improve this answer

There's absolutely no security reason for forcing the user to enter the password again after they've just changed it. Whoever set the password knows it now, so you might as well log them in.

I suspect plain laziness or ignorance: Adding an automatic log-in requires the programmer to actually think about the problem and write extra code. It's easier to just do the minimum (changing the password) and leave everything else to the standard log-in page.

share|improve this answer

Possibly the reason is that by logging-in the user as part of the password reset process, you create a new security surface, that you have to audit - in addition to "standard login" and "password reset" you now also have "login while resetting password".

By forcing the user to go through the standard login process, you eliminate that issue, by always doing the login the same way at the same place.

(Yeah, programmer's laziness is a big part of that, too :-))

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.