Skip to content

updates to rec for Token is Not Invalidated After Login #458

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RRudder wants to merge 2 commits into
base: master
Choose a base branch
from
Open

updates to rec for Token is Not Invalidated After Login #458

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09fd761
updates to rec for Token is Not Invalidated After Login
RRudder May 15, 2023
73fb04f
Fixed spelling error on guessing
RRudder May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions ...rd_reset_implementation/token_is_not_invalidated_after_login/recommendations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# Recommendation(s)

The password reset token should be invalidated after a user successfully resets their password and logs into the application. Overall, the password reset implementation should conform to the following guidelines:
It is best practice to invalidate the password reset token after after a user successfully resets their password and logs into the application. Overall, the password reset implementation should conform to the following guidelines:

A secure password policy should be in place for the user to create a strong new password
Password reset tokens should be long to protect against brute force guessing attacks, linked to an individual, invalidated after use, and have a short expiry time
Passwords should be stored and transmitted securely
Once a user’s password has been reset, they should be prompted to login in again through the usual login portal and not automatically signed in
- A secure password policy should be in place for the user to create a strong new password
- Password reset tokens should be long to protect against brute force guessing attacks, linked to an individual, invalidated after use, and have a short expiry time
- Passwords should be stored and transmitted securely
- Once a user’s password has been reset, they should be prompted to login in again through the usual login portal and not automatically signed in

For more information refer to the following guide relating to this vulnerability:
<https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html>