0

Is it alright to keep an account locked after the password reset? Say, for example, I have an account locking mechanism that will lock the account for 5 minutes after 3 tries.

Now the user performs a password reset and is successful. Should I keep the account locked and wait for the 5 minutes to complete or should I already unlock the account?

migrated from softwareengineering.stackexchange.com May 7 at 14:42

This question came from our site for professionals, academics, and students working within the systems development life cycle.

  • 1
    I would unsubscribe from a service that keeps me locked in the scenario you described. Why do you even consider this? Do you hate your users? (Joking aside, IMO it’s a bad idea) – Rik D May 7 at 5:26
  • What's your reason for maintaining the lock? – schroeder May 7 at 14:56
  • @Rik D. I want to make the site secure and this will serve as punishment for forgetful users hehe. yeah I see what you mean. I'll get this fixed and not justify it further. – niccolo m. May 8 at 1:21
  • @schroder, my app by default works this way. I am just trying to see if this is ok but apparently it is not and would have to change the implementation. – niccolo m. May 8 at 1:22
4

This depends on why the account was locked in the first place.

If the account was locked due to too many failed login attempts and the password reset procedure is also used to "recover" forgotten passwords (as in, the 'forgot password' link on the login screen sends the user into the password reset procedure), then it serves no purpose at all to keep the account locked after the password was reset successfully.

On the other hand, if the account was locked for administrative reasons (for example, the user got a temporary ban due to misconduct), then a password reset should definitely not unlock the account.

And there are many other situations somewhere in-between.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.