I have a workflow like this right now:
- User inputs the account email and clicks the "forget password" button
- User receives an email containing a link with token for password reset
- User clicks on that link, we check for that token from the user's request. If we cannot verify that, we redirect the user away; if we can verify that, we show the user input for changing the password
Would requiring users to input their email again in Step 3 increase security?
Assuming a malicious actor gets control of the gateway of that victim, and has access to the request log and can see the token we put in the URL. If the user clicked on that link, but didn't complete the process to consume that 1-time user token, that actor can then reuse that link for a password reset. Is that a legitimate concern?