I have typically implemented password reset functionality by sending a link that included something like this:
pwreset page I will typically request a few resources from third parties. From what I understand, since I have sensitive information in my URL at this point, it could be revealed to these third parties in the
referer header when the request is made.
While I trust these parties, I would prefer that they don't see URLs that would give them the ability to reset passwords or have this information logged on their end and available should their system be compromised.
A few questions:
- Is it possible to implement a password reset page that includes third party resources without disclosing the
- Where else, besides the third party, would this information be visible (if anywhere)?