🔁
Password Reset
Authentication
Account recovery flow to set a new credential; must resist takeover via token theft, email compromise, and social engineering.
Definition
Resets typically use short-lived single-use tokens and step-up checks. Security depends on token lifetime, rate limits, safe UX, and secure channels. Providers should avoid account enumeration.
In plain English
Account recovery flow to set a new credential; must resist takeover via token theft, email compromise, and social engineering.
Why this matters
Why it matters: A weak reset flow can bypass strong passwords and MFA.
Example
Example: Use short-lived tokens, notify users of resets, require step-up verification for risky resets, and throttle attempts.