Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Lets say password reset functionality flow is the following:

  1. User submits email address used for his account.
  2. An email is sent to that email address with a link with a password reset hash.
  3. Upon clicking, a user can reset password.

I see websites redirect a user to a login page after a password reset is complete. Is there a security risk in logging in user automatically after password reset is complete?

share|improve this question
1  
There is also a usability perspective. You are less likely to forget the password if you are forced to enter it immediately. –  Deer Hunter Aug 16 '13 at 13:51

6 Answers 6

up vote 2 down vote accepted

There's no difference. If a hacker got to the link, then he can anyway reset the password and log in again. It makes no difference to him, he can't further abuse the feature.

The only time it makes sense to do this is if your using some form of multi factor authentication. Of course, in that case, one would expect you to include the multi factor bit in the reset workflow as well.

share|improve this answer
    
Accepting this answer because of the "multi factor authentication" piece that I didn't think of. –  Dmitry Feb 18 '13 at 19:21

From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral. Neither behaviour is inherently more secure than the other. I suppose that most sites do what was simplest to implement on the server side.

A point to consider is that security is achieved as long as everybody cooperates; in particular, the principle of least surprise is of paramount importance. That principle, applied to security, means that trouble is afoot when things don't occur as the human user expects it. In this case, the human user may or may not expect to be logged in after a reset. Let's see what happens if the user is "surprised":

  • If the user expected to be logged in, and is not, then he may be somewhat irked by the necessity to enter his password again. However, consequences stop there. Notably, the requirement to have to enter the password a third time will not induce the user to choose a weaker but easier to type password, because, by definition, he was not aware of this third entry when he chose the password.
  • If the user did not expect to be logged in after a password reset, and still is logged in, then that user may simply not notice that he is logged in, and remain so. This contradicts the user control of open sessions (the reason why most sites have a prominent "logout" button).

In that sense, a (rather weak) case can be made against logging the user automatically on password reset: security consequences of an unnoticed login can be worse than consequences of an unexpected lack of automatic login.

share|improve this answer

Anytime you are writing code you have to think to your self, "How can an attacker abuse this functionality?" Not having this internal dialog is very dangerous as the programmer will probably expose dangerous functionality. Not fully understanding the attacker's perspective will lead to looking at vulnerabilities that could never exist.

So in this case:

How could an attacker possibility benefit from automatically logging in after they have reset the password of a victims account. In this case clearly the damage is already done, and automatically logging in a user is the least of your concern.

share|improve this answer
    
thanks for feedback, I thought the same way as you. The reason I asked this question is that I see other websites do that and it does not make sense to me. So I thought there might be something I do not know –  Dmitry Feb 18 '13 at 19:16
    
Note that if you are using some form of multi factor authentication, keeping the user logged out after a password reset is better. –  Manishearth Feb 18 '13 at 19:17

It's probably just to confirm he chose the right password, what happens if you browse away from the password page on the site?

Normally when you forgot a password a one-time token is generated (often a link) which allows you to change your password and then log in.

If they immediately log you in using the one-time token after which you can change your password, it's a bit weird but not entirely less secure. After all if you can change the password, you could easily log in afterwards anyway.

The important thing is to check if, after using the token, it is invalidated. If the token allows you to change your password over and over again, then there is indeed a security issue.

share|improve this answer

If you change your password, all of your existing login sessions might be cleared, so that a villain who has your password gets logged out, too.

The fact that you don't get logged in immediately afterwards, or that they don't preserve your current session might just be programmer's lazyness, or what Lucas said.

share|improve this answer
    
Mental -1 for the first line. Invalidating the previous sessions has nothing to do with the ability to create a new session for the user after resetting the password. After all, you trusted that he's the email owner and rest the password for him based on the token, so why not log him in based on the token? Your second point, however, is correct. It could be laziness. –  Adi Aug 16 '13 at 14:30
    
@Adnan I think you and copy are pretty much saying the same thing. –  Iszi Aug 16 '13 at 14:32
    
@Iszi It's very likely that you're indeed right. –  Adi Aug 16 '13 at 14:33
    
@Adnan Yeah, I get that a lot. ;-) –  Iszi Aug 16 '13 at 15:13

Assuming the link does not give away any username information (which it shouldn't), and username is not user's email address (which it shouldn't be, but unfortunately sometimes is), then being able to reset "someone's" password will not be of any benefit to the attacker, unless the system automatically logs them in. Re-authentication is the preferred approach, but the risk is relative to the required security of the system.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.