Why should password reset link be single use?

Question

Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html

It mentioned that password reset link should be single use and expire after appropriate period. I don't understand why should it be single use?

Also found this: https://www.troyhunt.com/everything-you-ever-wanted-to-know/

Finally, we want to ensure that this is a one-time process. Once the reset process is complete, the token should be deleted so that the reset URL is no longer functional. As with the previous point, this is to ensure an attacker has a very limited window in which they can abuse the reset URL.

So the whole point of being "single use" and "time-limit" is to limit the window... but if the time limit is fairly short (eg: 30 minutes), is it okay for the link to not be single use? Is this another security vs convenience topic, or is there any reasons why it must be single use that I am not aware of?

I'm new in this section of SE (and to security in general), so if mod thinks there are better tags, feel free to change it.

Answer 1

The threat that is being mitigated by the single use is that someone else uses (or re-uses) the url to reset the password.

• If the url does not work, apparently someone has intercepted the mail and you know someone else has the password
• If the url is used normally, you no longer need to worry that someone else uses the same link to (re-)appropriate the account.

A short period of time also mitigates this threat, but less effectively. For example: if the URL is valid for an hour, and you changed your password directly after receiving the URL, there is still a one hour time slot where a miscreant could abuse the link. To be absolutely sure that the link would not be re-used, you would have to re-login after the time-out.

Whether it is OK depends quite a bit on the application. It would not bother me for a registration that is required for downloading a whitepaper, but for my bank, I really want the one-time-use.

Answer 2

Many of these recommendations follow the best practices standards. There is a chance that reset links might be cached (e.g. in the browser or other caching mechanisms), therefore accessible at some point from a 3rd party. This gives a window of compromise (even small if we set a small expiration time) which can be removed by using the one time use.

Also consider the situation where links do not get invalidated but only have a time expiration period. Someone can generated multiple links and attempts to bruteforce/guess a valid reset link. This is a bit different than your question but shows a realistic attack scenario, where we need to invalidate old reset tokens (links) when new ones are created