1

I've encountered the situation where the email client checks all links in emails, so that when I send an email with a reset password link, the user gets the new temporary password in the next email at once. But it should be sent only if the user clicks the link.

Reset scenario:

  1. User enters login and email address and press reset button
  2. User gets an email with the reset link
  3. User clicks the link
  4. User gets an email with temporary password
  5. User logs in with temporary password

Could you recomend a solution to this problem?

Improve this question

1 Answer 1

Reset to default
2

You could insert captcha on temporary page. It will exlude any automatical clients.

In addition, to spare users' time, you can create a whitelist of popular user-agents where captcha won't be needed. This way most users will not see additional step and you will be protected against automatical clients.

NOTE: This is NOT protection in terms of security. Remember that user-agent can be extremely easly spoofed by any client.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .