Timeline for Secure forgot password page: Is a server-stateless implementation viable?
Current License: CC BY-SA 3.0
2 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 4, 2017 at 13:45 | comment | added | Petar Donchev | On a side note, email is in general not secure transport, so if you have any form of second factor auth available, this is the place to use it (after link is verified, before password reset). Another, composable, option is to set a unique token in a httponly secure cookie when you offer the reset form and include it in the signature. In the mail do not send a link, but just a token and request the user to copy paste it in a new form in the same browser window - basically name sure this is the same session. | |
| May 4, 2017 at 13:39 | history | answered | Petar Donchev | CC BY-SA 3.0 |