javascript - Requiring authentication after credentials change -
is bad pattern or best practice. user has changed password after "forgotten password". need redirect him login page , prompt him log-in or should automatically log him in application?
if either, why?
i can't imagine security advantage of requiring him login after changed password forgotten password. however, there may usability benefits such as: (1) reinforcing in user's memory new password is, , (2) allowing browser store new password not need type in next time login browser.
it common redirect user login new password.
Comments
Post a Comment