Use case is to prevent any dictionary attack on forget password flow, where attacker can trigger any no. of emails using forget password flow.

  • 4
    What kind of forget password system is it? Do you have to answer a secret question? Or do you just get an email with the reset code? What is it that would be brute forced with a dictionary?
    – Anders
    Oct 3, 2016 at 10:43

1 Answer 1


A user selecting the 'Forgot Password' button should only be able to enter a valid user email address and be required to then only interact with the system to reset the password via the link provided in an email to that address.

Furthermore, the link provided needs to have a time-out value assigned to it so it is only valid for perhaps 30min at the most. If an attacker already has compromised a valid users email that is used to login there isn't a lot that could be done and that person would not need to brute-force the login.

But, to stop brute-force logins just put in a limit of failed attempts before the IP address is no longer permitted to attempt a login

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.