Secure your Web Application's Reset Password flow

ByKarthik Kumar D Kon22nd Jan 2023, 2023-01-22T08:00:00+05:30
Read
Pause
Resume
Stop
Secure your Web Application's Reset Password flow

Generally any application framework provides users to have a flow to reset the passwords by default, It is more like, use clicking on the Reset Password link and redirects to a page where he will asked for email, and reset link sent to users email, so that user can reset the password on their own.

This is a default or general flow that any application framework provides, but developers or architects have to make sure, this flow is more secure than just an email confirmation.

And, in this article we are gonna see certain inputs, which help developers or architects to design and develop a better secured recovery password flow in the web application.

1. Set expiry on reset password link

Make sure the reset password link expires in a certain amount of time, so that the user is entitled to reset the password in that interval of time. And also the link will not be available for users forever to reset the password.

2. Application to identify reset password link

Always make sure the web application will identify the reset password link that is shared to the user. This can be done by adding the token to the reset password link and validating the token with application secure storage, when the user uses the reset password link and resets the password.

3. Password should be set complex

Allow users only to set the complex passwords, don’t allow users to set simple passwords.

  • Alphanumeric Character types (one digit, one letter and one punctuation)
  • Uppercase and Lowercase
  • Length of minimum 8 characters
  • Don’t allow username or email as password.
  • Check history of password (avoid users to set old passwords.
  • Avoid generic passwords (like admin, admin123 etc)

4. User Sessions

During the password reset flow (while the reset is triggered by users), make sure to clear all the sessions of the users from the application, including in other devices.

5. Hash the passwords

Use the latest and most secure encryption algorithm to hash the passwords.

6. Have questions on reset password form

This is quite an extra step, but this can be helpful to make sure the reset password flow is secured with one more step.

7. Logging

Avoid logging the sensitive information related to passwords or password hashes or the input provided by users which is sensitive and can crack the reset password flow.

8. Limit Password retries

This can be applicable in certain cases, but should not be applied for all the cases.

  • Multiple reset password requests from a certain IP, in this case limit the reset of password.
  • Multiple failed login attempts in a short interval of time from different IPs, then avoid this request. Have something like 3 attempts for failed login and should wait for sometime.
  • Also look into the brute force attack to set such a limitation on the password reset workflow.

9. TFA

Having a two factor authentication is one more step of securing the reset password workflow.

10. Captcha

Have Captcha on the reset password form, so that it adds one more step of security to the flow.

These are some basic and informational inputs on the reset password flow. Thanks for reading the article, for more science and technology related articles read our peoples blog articles.

1,600OFF
Xtore Beautiful Finish Uniquely Hand Crafted Home Dcor African Tribal Women Art Piece - (Set of 3, Multicolour), Resin

Xtore Beautiful Finish Uniquely Hand Crafted Home Dcor African Tribal Women Art Piece - (Set of 3, Multicolour), Resin

899 2,499
These uniquely hand crafted and painted resin black African tribal lady figure make an excellent compliment to any home/office decor. It makes a great display for culture/tradition appreciation events and a perfect gift for your loved ones. Unique and Rare - Hand Painted and Hand Crafted.
Home & Decor
13,000OFF
OnePlus 108 cm (43 inches) Y Series 4K Ultra HD Smart Android LED TV 43Y1S Pro (Black)

OnePlus 108 cm (43 inches) Y Series 4K Ultra HD Smart Android LED TV 43Y1S Pro (Black)

26,999 39,999
Resolution : 4K Ultra HD (3840x2160) | Refresh Rate : 60 Hertz. Connectivity: 3 HDMI ports to connect set top box, Blu Ray players, gaming console | 2 USB ports to connect hard drives and other USB devices | Dual-band Wi-Fi Sound : 24 Watts Output | Dolby Audio | Dolby Atmos Decoding. Smart TV features: Android TV | OnePlus Connect Ecosystem| Google Assistant | Chromecast, Miracast, DLNA | Auto Low Latency Mode | Supported Apps : Netflix, Youtube, Prime Video, Hotstar, SonyLiv, Hungama, JioCinema, Zee5, Eros Now, Oxygen Play.
Televisions
7,000OFF
OnePlus 80 cm (32 inches) Y Series HD Ready LED Smart Android TV 32Y1 (Black)

OnePlus 80 cm (32 inches) Y Series HD Ready LED Smart Android TV 32Y1 (Black)

12,999 19,999
Resolution: HD Ready (1366x768) | Refresh Rate: 60 hertz. Connectivity: 2 HDMI ports to connect set top box, Blu Ray players, gaming console | 2 USB ports to connect hard drives and other USB devices, Dimensions(TV With Stand) - 71.3cm x 20cm x 46.9cm | VESA Hole Pitch - 20cm x 20cm. Sound : 20 Watts Output | Dolby Audio. Smart TV Features: Android TV 9.0 | OnePlus Connect | Google Assistant | Play Store | Chromecast | Shared Album | Supported Apps : Netflix, YouTube, Prime video | Content Calendar | OxygenPlay. Display : LED Panel | Noise Reduction | Colour Space Mapping |Dynamic Contrast | Anti-Aliasing | DCI-P3 93% colour gamut | Gamma Engine | Design: Bezel-less | Screen/Body Ratio = 91.4%. Warranty Information: 1 year comprehensive warranty and additional 1 year on panel provided by the manufacturer from date of purchase.
Televisions

Related Articles

1,031OFF
eCraftIndia Ganesh Deepak with Bell Brass Wall Hanging (11 cm x 8 cm x 24 cm, Brown)

eCraftIndia Ganesh Deepak with Bell Brass Wall Hanging (11 cm x 8 cm x 24 cm, Brown)

968 1,999
1 Brass Ganeshs wall hanging Deepak with bell and Dancing Ganesha. Don't wash, use dry/wet cotton cloth to remove dirt.
Home & Decor

Recent Articles

Recent Quick Read

Recent Great People

32,991OFF
Hisense 139 cm (55 inches) Tornado 2.0 Series 4K Ultra HD Smart LED Google TV 55A7H (Silver)

Hisense 139 cm (55 inches) Tornado 2.0 Series 4K Ultra HD Smart LED Google TV 55A7H (Silver)

36,999 69,990
Resolution : 4K Ultra HD (3840x2160) | Refresh Rate : 60 Hertz | 178 Degree wide viewing angle. Connectivity: 3 HDMI ports to connect set top box, Blu Ray players, gaming console (HDMI 1 eARC supported) | 2 USB ports to connect hard drives and other USB devices | Dual-band Wi-Fi | Bluetooth 5.1. Sound : 102 Watts Output | JBL 6 Speakers System | Dolby Atmos for remarkable sound quality. Smart TV features: Google TV with Watchlist | Google Play Store | Google Assistant | Chromecast, Miracast, DLNA, Airplay | Auto Low Latency Mode for VRR | Supported Apps : Netflix, Youtube, Prime Video, Hotstar, SonyLiv, Hungama, JioCinema, Zee5, Eros Now. Display :10 bit Panel | Bezel-less Floating Display Design | ALLM | Decoding of Dolby Vision, HDR10, HLG | 1 Billion Colours | MEMC. Warranty Information: 2 Year Comprehensive Warranty on product provided by Hisense from date of purchase.. Installation: For requesting installation/wall mounting/demo of this product once delivered, please directly call Hisense Support for assistance (Please visit Hisense Website for Toll Free Numbers) and provide product's model name and seller's details mentioned on your invoice. The service center will allot you a convenient slot for the service. Easy Returns: This product is eligible for replacement within 10 days of delivery in case of any product defects, damage or features not matching the description.
Televisions
26,991OFF
Hisense 139 cm (55 inches) Bezelless Series 4K Ultra HD Smart LED Google TV 55A6H (Black)

Hisense 139 cm (55 inches) Bezelless Series 4K Ultra HD Smart LED Google TV 55A6H (Black)

32,999 59,990
Resolution : 4K Ultra HD (3840x2160) | Refresh Rate : 60 Hertz | 178 Degree wide viewing angle. Connectivity: 3 HDMI ports to connect set top box, Blu Ray players, gaming console | 2 USB ports to connect hard drives and other USB devices | Dual-band Wi-Fi | Bluetooth 5.1. Sound : 24 Watts Output | Dolby Atmos | Dolby Digital. Smart TV features: Google TV | Watchlist | Google Assistant | Far Field Vioce Control | Chromecast, Miracast, DLNA | Auto Low Latency Mode for VRR | Supported Apps : Netflix, Youtube, Prime Video, Hotstar, SonyLiv, Hungama, JioCinema, Zee5, Eros Now. Display :10 bit Panel | Bezel-less Floating Display Design | ALLM | Decoding of Dolby Vision, HDR10, HLG | 1 Billion Colours | MEMC.
Televisions
350OFF
Amazon Brand - Solimo Slim Stainless Steel Water Bottle, Set of 3, 1 L Each

Amazon Brand - Solimo Slim Stainless Steel Water Bottle, Set of 3, 1 L Each

649 999
Stainless Steel water bottle set for home and office use. Made using high quality stainless steel for added durability and long life. Made from 100% food grade materials to be safe for everyday usage. Features a spill-proof design; has a snug fitting lid for easy usage and prevention of leaks. Ergonomic design for comfortable grip and rust free body. Ideal for storing water, iced tea, juices, shakes and more. Dimensions: L x W x H: 7.3 x 7.3 x 26 cm. Package Contents:- Solimo Stainless Steel Water Bottle Set of 3, Weight: 200 gm each, Colour: Silver, Capacity: 1 litre each.
Kitchen & Dining
1,272OFF
Bajaj Rex 500W Mixer Grinder, Purple

Bajaj Rex 500W Mixer Grinder, Purple

2,278 3,550
Wattage : 500 W, Voltage: 230V~50 Hz: Revolution: 20,000 RPM. Powerful 500W Titan Motor with Radio Knob: Easy selection of Speed. 2-in-1 Blade: The dry grinding jar can be used for dry and chutney grinding both. Product warranty by Bajaj - 2 Years. T&C Applied. Pulse Mode: Used for mixing and grinding without stopping your mixie. Perfect to mince chicken , get bread crumps, small puree and making lump free gravies.
Kitchen Appliances
We Need Your Consent
By clicking “Accept Cookies”, you agree to the storing of cookies on your device to enhance your site navigation experience.
I Accept Cookies