Teams spend weeks
on the login form.
Hashing, rate limits,
a second factor,
a session cookie
with every flag set correctly.
Then the user forgets the password,
and everything they just built
is bypassed by an email.
Password recovery is not a side feature.
It is a login
that runs on weaker rules,
and attackers know it.
Start with the token.
If it is short,
or predictable,
or derived from the user id
and a timestamp,
it is guessable,
and guessable is the same as public.
Make it long and random.
Make it single use.
Make it expire in minutes,
not days,
because a reset link
sitting in an inbox for a week
is a spare key under the mat.
Then ask the harder question.
What happens after the reset succeeds?
If the old sessions stay alive,
the person who stole the account
keeps it,
and the real owner
has just changed the lock
on a door the thief is already inside.
Kill every session on reset.
Every device, every token,
including the one
that did the resetting
if you want to be strict.
Now look at the email change flow,
because that is the reset flow
with an extra step removed.
Change the address,
request a reset,
receive the link.
If changing an email
does not require the current password
and a confirmation
to the old address,
you have built account takeover
as a feature.
And look outside the code.
Somebody at a support desk
can probably reset anyone
after two questions
that a stranger could answer
from a public profile.
That is your real recovery flow.
Not the one in the repository.
Test it the way an attacker would.
Request a reset for an account
you do not own.
Use the link twice.
Use it after an hour.
Use it, then check
whether the old session still works.
A lock is only as good
as the spare key
you forgot you cut.
– Serguey Asael Shinder
Top comments (0)