4 issues against password reset flow. Here's what I found.
Password reset looks like a 20-line feature. Until it has an email leak, a half-finished transaction, and more than one valid token at a time. I was building a task manager API for a skill assessment. Auth was supposed to be the boring part. Then I started reviewing my own password reset like someone trying to break it. I ended up with four issues and three PRs, and not one of them was a typo.…
Four issues surfaced during a review of the password reset flow in a task manager API. The first issue discovered was that the forgot-password feature inadvertently revealed the accounts of others to unauthorized parties. The second problem was that the login process itself could be compromised through timing attacks. The third issue arose from the reset password procedure taking three separate database steps, leaving the system vulnerable to race conditions.
Lastly, multiple valid tokens could exist simultaneously, rendering all links ineffective when any token was clicked.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
