I have a workflow like this right now:

  1. User inputs the account email and clicks the "forget password" button
  2. User receives an email containing a link with token for password reset
  3. User clicks on that link, we check for that token from the user's request. If we cannot verify that, we redirect the user away; if we can verify that, we show the user input for changing the password

Would requiring users to input their email again in Step 3 increase security?

Assuming a malicious actor gets control of the gateway of that victim, and has access to the request log and can see the token we put in the URL. If the user clicked on that link, but didn't complete the process to consume that 1-time user token, that actor can then reuse that link for a password reset. Is that a legitimate concern?

  • Welcome to the community. If in the alternative scenario the user would only click on the link and it would be resetted to a random password and sent it by e-mail - yeah, definetely Commented Jun 1, 2023 at 15:54

1 Answer 1


If a malicious actor can get the token, then they are likely to be able to get the email, too. Either from the email you send or from your system relating that token to the account.

I see little to no benefit in requiring the user to input their email again when they click the link you send them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .