Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Lets assume following flow:

  1. I want to log in
  2. I don't remember password
  3. I click on the "forgot my password" link (email is dispatched)
  4. I check my inbox and click on the link
  5. I type in password and confirmation
  6. Done

Why, after performing these steps, am I not logged in but instead presented with log-on screen? If we refer back to 1. then it seems obvious that I would like to log in.

Are there any use cases when someone would like to change their password via "forgot my password" link and then not log in? Unless I'm missing something obvious, the intention is clear and identity was established by using reset link from email.

Please tell what are your thoughts, please tell whether the user should be logged in after resetting the password?

Related: Should confirm email links autologin if the user is not logged in? (my answer would be yes)

share|improve this question
    
    
I don't see the problem. Remember, they are users and can do whatever they like and not only the steps you pave out for them. You have to be flexible. Why wouldn't you like when somebody doesn't log in immediately after requesting a new password? Put a time limit on the link, or a amount of requests/day if you like. –  Dirk May 29 '13 at 8:07
    
As you've suggested, there is a very closely related question to this one. What is it that differs your question from that one, as they appear to be both covering the same ground? –  JonW May 29 '13 at 8:30
    
I agree that these two are closely related. Reason for differentiating - here are two possible workflows: 1) I just want create an account and access it later 2) As an online marketeer I would like to receive their onboarding emails as reference material. Remember: users and can do whatever they like (via @Dirk) –  Michal Stefanow May 29 '13 at 10:01
1  
I think this question should also be asked on security.stackexchange.com since it has security implications as well. Having the question on both the UX and security boards would let us see the issue from both perspectives. –  Kevin May 29 '13 at 17:11
show 1 more comment

5 Answers 5

In my opinion: YES.

The authentication has been done when the password is reset, so the user could be logged in. And it annoys the hell out of me when after password reset I'm not logged in.

I can't think of any case I wouldn't want to be logged in after resetting password, why would I even ask for password reset if I don't want to log in?

share|improve this answer

This post does not cite any references or sources. Please help improve this post by adding citations to reliable sources. Unsourced material may be challenged and removed.

1  
+1 it annoys the hell out of me (I was wondering if it is only me, glad I'm not alone) –  Michal Stefanow May 29 '13 at 10:02
    
+1 I agree it is a bit of a hindrance when completing all the steps and your presented with the log-on screen. –  Courtney Jordan May 29 '13 at 11:38
    
Yes - If there exists a history where auto re-logging in has caused significant problems, then I would say no. But the no reasons tend to fall in the class of "what is best for me" and not what is convenient for me. (First Post) –  chux May 29 '13 at 18:36
1  
Atleast having a "change password and log in" choice would be nice improvement on many cases... –  Samuel M May 30 '13 at 13:56
add comment

For the vast majority of situations users should be logged in once they have reset their password. Essentially, once you've authenticated someone enough for them to change a password, you've also authenticated them enough for them to perform the task that they likely wanted to perform.

There are however some relatively rare situations where this isn't feasible:

  • Where you have a username for a system, but it isn't clear which site you need to log into. For example, if you're an accountant and have a username / password for an online accounting system that you use for many clients. Often there will be separate domain names for each client such as client1.accounting.com and client2.accounting.com. Here resetting your password would apply across all related sites, but it isn't clear which site you should log into.

  • If the authentication is handled by a separate system to the the application. It's not that it wouldn't be good UX to do this, just that it may be a large technical headache, and so not considered worth the cost.

share|improve this answer
add comment

No. While it seems to be annoying, I see four problems with not having to enter the login information again:

  1. I will remember my new password better if I have to type it once more. (I keep forgetting my new e-banking password because I don't have to re-enter it, and I of course don't store it in the browser.)
  2. If I want to store the password, the browser PW manager is sometimes confused by the PW change and is not able to treat it properly; this is not the case when I enter a different PW into the standard login form
  3. Having to use the password is the best way to make oneself sure that the password has been really changed.
  4. (security) IMHO it's better when a user logs in only by LOG IN button and never by anything else like CHANGE PASSWORD button.
share|improve this answer

This post does not cite any references or sources. Please help improve this post by adding citations to reliable sources. Unsourced material may be challenged and removed.

1  
I would give three -1 for the options 1, 2 and 4, as I completely disagree, but the 3rd option is so brilliant, that in summary I give +1 :) –  Voitcus May 29 '13 at 10:44
    
@Voitcus They all are my opinions. However, as well, I was unhappy about 2 "yes" answers being here with a "no" answer missing that would state the counter-arguments. –  tohecz May 29 '13 at 10:54
    
The big security concern here is if the reset isn't handled properly. Let's say for instance if the key used in the URL isn't removed, then if someone got that key from your email, browser cache, or even server log files then they wouldn't need your password to log in. It probably doesn't have much impact on the original question, but just a note for the security. –  Chris May 29 '13 at 16:18
3  
None of these reasons are good reasons for the user to have to deal with this. 1 is nonsense on a number of levels, 2 is something users shouldn't have to deal with, 3 can be handled much better by just giving proper feedback, and 4 I just totally don't get. –  Koen Lageveen May 29 '13 at 19:22
1  
+1 primarily for #2, I log out then back in just to get Firefox to update it correctly –  Izkata May 30 '13 at 3:33
show 3 more comments

Why not create two buttons "Change password & Login" and "Just change password"? Having another option doesn't hurt in my opinion.

share|improve this answer
add comment

The situation is bit controversial. Actually it depends upon the user's perspective of how the user reacts depending upon the situation.

We can explain the situation by using 2 point of views :

  1. From user's point of view, it is obvious that he/she may think of not entering the password again once he/she changed that. In that case the user may be annoyed and think that re-entering the password will be sheer waste of time. So, it is correct not to enter the password again.

  2. From the technical perspective(especially testing point of view), it may happen that the user might have logged in the account few days back using any other device like mobile,tablets etc.

So, once the password is reset, then the user is again prompted for entering the new password so that the confirmation will be sent to the system as the password is changed. Hence it is required to enter the password again.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.