A lot of companies and organisations does not do password resets properly today. Here is a recipe on how to do it securely.
- User enters the login page. This must be loaded over HTTPS.
- User clicks the “Forgot password” button. The user must then supply something unique to the user, e.g. email or username.
- The backend system affirms the details submitted, but does not give away if the details are correct or not. The system simply states that “A password reset email has been sent to the user, if it exists”.
- The system sends an email to the email address behind the username . The email must contain the following:
- Who ordered the email? IP address and the country behind that IP is useful information.
- Time and date the reset was ordered.
- Some information regarding the password reset function and a notification to ignore this email, if it was not them who ordered it.
- A unique link back to the system where the password reset in itself is done. The link needs to have the following properties:
- It should contain a high entropy unique key, e.g. a long and strong unique key. This key should be as good as impossible to guess.
- A fixed time the key is valid, e.g. the link only allows password resret if it is clicked within 15-30 minutes.
- The link must be loaded over HTTPS.
- Inform on the duration the link is active and that it is a one-time use link.
- The user is then taken to a form where he can enter his new password.
- Send a new email to the user, notifying that his password was in fact changed.