Password reset by emailing temporary passwords

前端 未结 4 1389
抹茶落季
抹茶落季 2021-02-04 11:19

A group in my company is implementing a single-sign-on REST API for our applications. This authentication service has a password reset function. The application sends the user

4条回答
  •  一个人的身影
    2021-02-04 12:10

    Are there any significant security reasons to prefer one method over the other?

    Yes. If you go the temporary password route then anyone can annoy the crap out of a user by constantly hitting the reset link and putting in that user's email address. If you use password reset links the user can just ignore them and delete the emails.

提交回复
热议问题