We want to set up a flow something like this:
- We create account for a high-value user from our admin section
- They get an automated email containing login details for our site in some form
- They follow the link, confirming their account, and see a form that prominently asks them to reset their password
- This seems to be the tricky bit: if they navigate away before setting their password and come back later (having potentially logged out/come from another machine etc) we want them to still be able to access their account without having to request a password reset
As far as I can see there's no secure way of doing this, since it would require at least a repeat-use login token to go to them via email.
So my questions are:
1) Have I missed some way of doing this securely? (with apologies to theI3I, who answered a similar question I posted without the fourth requirement here)
2) One approach we've discussed is sending them a reusable login token with an expiry date, so that a) at least it's not going to get broken by a rainbow attack, and b) we minimise the window of vulnerability. I know this isn't ideal, but (if there's a meaningful way to answer this question) how big a risk is this? Does it matter much how long the use period is? And is there any way to minimise the risk other than just reducing use period (or also-imperfect-but-better way to achieve the same desired effect)?
If relevant, we're using a Rails/Devise backend.
Thanks in advance.