This question already has an answer here:

I have very, very rarely gone to a site solely to reset my password. Why then, after going through a password reset process, does the conclusion of the process ask me to login again with the new password?

What is gained by this, instead of just passing me along to the "you have successfully logged in" portion of the site, once I have successfully changed the password?

I have seen this pattern used in quite a few well known sites, so I assume there must be some good reason for it.

marked as duplicate by PwdRsch, Steffen Ullrich, Rory Alsop May 6 '17 at 7:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

It's safer to avoid handing out a session token on a successful reset. It also helps reinforce the new password to the user or makes the user's password manager more likely to detect the update. The part of the code that handles locked out users should be totally independent of the part that authenticates them.

I can see 3 reasons for this process:

  • It's easy to implement. The application changes the password of the user then log them out properly, clearing the authentication token in the database. When the user logs in again, a new authentication token is issued. This avoid any unforeseen incoherent behavior of the application.
  • This allows the browser to notice the password change. When logging in, the password manager of the browser can ask to update the password with the new one.
  • This process ensures that the user can log in with the new password. The user will notice immediately if they do an error.

So basically, this is more a decision based on application design or UX concerns than on security requirements.

Not the answer you're looking for? Browse other questions tagged or ask your own question.