Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the password is reset?
If you disabled the account I could see this being abused by an 3rd party (i.e. requesting a password reset for an account not their own) and make it more difficult for the real user to login.
Thoughts?
As you say, you must allow the user to continue logging in otherwise this could be abused. If you locked them out effectively you are creating a Denial of Service vulnerability by letting an attacker deny service to a legitimate user.
I cannot see what is achieved by locking the user out. if you are preventing someone who has gained access to the user credentials from continuing to use the account, you would best achieve this by invalidating any user sessions (apart from the current session) upon successful password reset (once the link has been followed and a new password set).
They should be allowed to log in after the email is sent.
After all clicking on the reset link in the email is what triggers the reset, not requesting the email. As you mention yourself, locking the account when asking for reset mail could lead to abuse.
