What to show after being rerouted to application from reset password email, but I've logged in

Question

Consider the scenario:

I am on the login screen and forget my password. I go to the "forgot password" screen, which asks for my email. I fill it out, and I am sent a 2FA email.

Path 1 - "Happy" path

I check the email, click the link, and am routed back to the application. The application is in a logged-out state (aeshetic 1), and I am shown a screen to enter a new password, confirm it, and click the "reset button". Once this form is submitted, there is a "Log in" button, which takes me back to login, where I can use my new password.

Path 2 - Interrupted path

While waiting for the email, I remember my password, and log in successfully.

I get the email. I click the link, which routes me back to the application. The application is already in a logged-in state, which looks very different from the logged-out state (aesthetic 2).

Should I still be shown the next phase of the forgot-password flow (i.e. put in a new password, with password confiration)? Do I need a new design which combines the "forgot password" look of aeshetic 1 with the logged-in look of aeshetic 2? Should I simply show a message saying that the forgot-password link has expired, now that they logged in?

Note this application also has a settings section, where a user can update their password as a logged-in user. It has a slightly different look (and set of api calls) than the 'forgot password' flow. It is also a 2FA flow - put in current email and password -> receive email -> click link that routes back to page -> input new password and confirmation and click 'update' -> done.

Should Path 2 simply route to the confirmation step of the "update password" flow described in the above paragraph? This is more complex from a coding perspective, but I want proper UX on this.

Answer 1

If you send a password reset link and then the user logs in normally without it, you should expire the reset link. Whoever logged in with the correct password should be shown the normal logged in state.

If you send a password reset link and the user uses it, you should reset the password and also notify all the former email addresses you have on file that the password was reset and to call if not authorized.

After the password has been reset the user should be in a logged out state. This will keep it consistent with expectations since the user hasn't logged in yet.

On a side-note it will also reduce vulnerabilities, since there will be no weird transitions where the user is logged in without having actually logged in. The weird poorly defined glue parts are a prime area for vulnerabilities.

TL/DR. A password reset should reset the password. A login should login (or not). There should be no extra interconnections or seldom used paths.

Path 1, The "happy path" is the way to go.

Also I agree with @Gene-Lee, and would also show them a "You've been booted out because of a password reset" screen advising them to call if unexpected.

Answer 2

I think you need to consider that someone else may be signed in or "hacking" the other account, so making the password link expire will allow the hacker to continue their hacking. I would have the "password link" sign the user out and take them to aesthetic 1. This prevents your interrupted path from occurring in the first place.

Edit: If this account can be shared, then you can add an option under the change password that says "sign out of all devices" similar to how netflix does when you change your pass.