2

Say a user requests a password recovery on a computer. Our system then sends an email with a unique link to recover the account.

However now consider the user receives this email and opens it on his mobile phone (or any other device). He clicks the link, however on this device he is already logged in as another account.

So the naive implementation is that the user gets a password recovery while already logged in. Potentially to another account. This feels awkward an unintuitive: but I can't really decide on the correct course of action, I see several options and wonder what follow the principle of least astonishment:

  • Should the current behavior be kept, and allowing a logged in user to change the password for another user.
  • Should the current session be invalidated/user logged out upon opening the password recovery link?
  • Should the link just "not work" (forbidden error?) when trying to open on a device where already logged in?

And would this behaviour change if the request is for the "same" user? (IE on the other device he's already logged in on the user one does a password request for)?

  • Are users allowed to have multiple accounts? When they have multiple accounts, can they be associated with each other? What happens if a logged in user tries to go to the login page to log in as a different user? – 習約塔 May 23 at 15:26
  • Mail addresses can most certainly belong to multiple account. A user can't have multiple accounts though. (Think about consumers who have a standard mailbox for their family: they'd create multiple accounts for each member but use the same recovery email). This is not the expected behaviour though, and I'd like if it never happens - however considering our clientele (aimed at working for computer illiterates) it is not unthinkable. – paul23 May 23 at 15:32
  • 1
    Login in while already logged in will silently log you in to the new account, login out from the first account. However at front end this is "blocked" (menus are all hidden to do so) so a user would have to explicitly force doing this. – paul23 May 23 at 15:33
  • You should just log out any and all accounts, when user reaches password recovery page. Or keep the password recovery link separate from main application. That way, user can open the link in browser while still being logged in to the app. Obviously whenever app is opened, you do verify if last session is valid? If not, please do that. Whenever password is changed, invalidate the last session. So, once user opens the mobile app after changing password on PC, app will automatically redirect to log in page. – jitendragarg Aug 27 at 9:38
  • Related question: Password recovery workflow for app and website ux.stackexchange.com/questions/107165/… – Ren Aug 27 at 10:04
1

Hmm, the "reset password" screen should be a temporary, tokenized screen, divorced from any logged-in view.

In other words, even if they're logged in on the device they open the "reset password" screen on, the screen they see should have nothing to do with that logged-in account. It doesn't need to log them out, necessarily (that's up to your dev team to determine if they can maintain a tokenized page like that alongside a separate log-in).

To avoid confusion, both the email sent and the screen they land on should clarify what account they're resetting the password for (the actual reset screen could say: "You're about to update the password for oops@gmail.com").

  • The latter would show information though - it would show that there exists an account with said email address. Instead of just giving a "blank". Similarly how I make sure that when typing a password no stars are visible or any visible indication that a character was typed (took me quite the effort), so that over the shoulder looks cannot see the password length. – paul23 Aug 27 at 14:54
  • I'm not sure what level of security you're in need of, but not showing any password info while typing is pretty poor UX. As for showing the information, you can only view that screen if you clicked on a link from associated email address. Which already has an account (otherwise there is no way to get the "Reset password" email). It's not new information. If it really is problematic, fair enough, you don't need the email there. So long as the screen itself is clearly not logged in to their account, the email should be explanation enough on what they're doing. – Ben Paddock Aug 27 at 15:03
  • Oh I thought you meant "on requesting the link to be send", the screen that shows after you click the button "request password recovery dialog".. Not showing passwords is quite normal I think? I haven't known anything else from *nix machines. – paul23 Aug 27 at 15:10
  • Replacing text with a dot or star is common; showing no indication of typing at all is some next level security stuff. I guess if this is for a special government agency or super-secret business, that makes sense. – Ben Paddock Aug 27 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.