Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updates to rec for Token is Not Invalidated After New Token is Requested #457

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Updates to rec for Token is Not Invalidated After New Token is Requested #457

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions ...tation/token_is_not_invalidated_after_new_token_is_requested/recommendations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
# Recommendation(s)

The password reset token should be invalidated after each subsequent request for a password rest from a user. Overall, the password reset implementation should conform to the following guidelines:
It is best practice to invalidate old password reset tokens after each subsequent request for a password reset from a user. Overall, the password reset implementation should conform to the following guidelines:

A secure password policy should be in place for the user to create a strong new password
Password reset tokens should be long to protect against brute force guessing attacks, linked to an individual, invalidated after use, and have a short expiry time
Passwords should be stored and transmitted securely
Once a user’s password has been reset, they should be prompted to login in again through the usual login portal and not automatically signed in
- A secure password policy should be in place for the user to create a strong new password
- Password reset tokens should be long to protect against brute force guessinging attacks, linked to an individual, invalidated after use, and have a short expiry time
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"guessinging" ;)

- Passwords should be stored and transmitted securely
- Once a user’s password has been reset, they should be prompted to login in again through the usual login portal and not automatically signed in

For more information refer to the following guide relating to this vulnerability:
<https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html>