I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter the new password. So far so good. But at this point, they always prompt me to login again. Why? I just entered my password twice along with my login (email - of course this is done implicitly via the link). So why prompt me to login again? Is there a security reason for this that I am not seeing? Or is it just an old practice that seems to linger?
There is no reason this cannot be done technically, and I see the occasional site doing it. But it would require extra code to be built, so it's cheaper to let you handle the login ;-)
The same thing happens with the confirmation link when registering: in most cases you still have to login (but in this case there are relatively more sites that auto-login, in my experience).
This behaviour does indicate one good security practice: all sessions are invalidated on change password.
Perhaps the user is changing password because the old one has been compromised. In that case, invalidating all sessions helps protect the user.
It is true that there is no real need to invalidate the session that performed the password reset. But a website requiring a re-login tends to imply they are following good security practice, while websites that do not do this tend not to invalidate sessions at all.
I'm not 100% sure, but, after you clicked that password reset link, of course your password is changed, which means you cannot login with that credentials that have been provided with that link or password whatever it was. The credentials which had been logged you into that website somehow are expired. And after you successfully change your password, you can login with full privileges of your account/ profile. Just my opinion,though
There's absolutely no security reason for forcing the user to enter the password again after they've just changed it. Whoever set the password knows it now, so you might as well log them in.
I suspect plain laziness or ignorance: Adding an automatic log-in requires the programmer to actually think about the problem and write extra code. It's easier to just do the minimum (changing the password) and leave everything else to the standard log-in page.
Possibly the reason is that by logging-in the user as part of the password reset process, you create a new security surface, that you have to audit - in addition to "standard login" and "password reset" you now also have "login while resetting password".
By forcing the user to go through the standard login process, you eliminate that issue, by always doing the login the same way at the same place.
(Yeah, programmer's laziness is a big part of that, too :-))