Generally any application framework provides users to have a flow to reset the passwords by default, It is more like, use clicking on the Reset Password link and redirects to a page where he will asked for email and reset link sent to users email, so that user can reset the password on their own.
This is a default or general flow that any application framework provides, but developers or architects have to make sure, this flow is more secure than just an email confirmation.
And, in this article we are gonna see certain inputs, which help developers or architects to design and develop a better secured recovery password flow in the web application.
1. Set expiry on reset password link
Make sure the reset password link expires in a certain amount of time, so that the user is entitled to reset the password in that interval of time. And also the link will not be available for users forever to reset the password.
2. Application to identify reset password link
Always make sure the web application will identify the reset password link that is shared to the user. This can be done by adding the token to the reset password link and validating the token with application secure storage, when the user uses the reset password link and resets the password.
3. Password should be set complex
Allow users only to set the complex passwords, don’t allow users to set simple passwords.
- Alphanumeric Character types (one digit, one letter and one punctuation)
- Uppercase and Lowercase
- Length of minimum 8 characters
- Don’t allow username or email as password.
- Check history of password (avoid users to set old passwords.
- Avoid generic passwords (like admin, admin123 etc)
4. User Sessions
During the password reset flow (while the reset is triggered by users), make sure to clear all the sessions of the users from the application, including in other devices.
5. Hash the passwords
Use the latest and most secure encryption algorithm to hash the passwords.
6. Have questions on reset password form
This is quite an extra step, but this can be helpful to make sure the reset password flow is secured with one more step.
7. Logging
Avoid logging the sensitive information related to passwords or password hashes or the input provided by users which is sensitive and can crack the reset password flow.
8. Limit Password retries
This can be applicable in certain cases, but should not be applied for all the cases.
- Multiple reset password requests from a certain IP, in this case limit the reset of password.
- Multiple failed login attempts in a short interval of time from different IPs, then avoid this request. Have something like 3 attempts for failed login and should wait for sometime.
- Also look into the brute force attack to set such a limitation on the password reset workflow.
9. TFA
Having a two factor authentication is one more step of securing the reset password workflow.
10. Captcha
Have Captcha on the reset password form, so that it adds one more step of security to the flow.
These are some basic and informational inputs on the reset password flow. Thanks for reading the article, for more science and technology related articles read our peoples blog articles.
