44

Lets assume following flow:

  1. I want to log in
  2. I don't remember password
  3. I click on the "forgot my password" link (email is dispatched)
  4. I check my inbox and click on the link
  5. I type in a new password
  6. Done

Why, after performing these steps, am I not logged in but instead presented with log-on screen? If we refer back to 1. then it seems obvious that I would like to log in.

Are there any use cases when someone would like to change their password via "forgot my password" link and then not log in? Unless I'm missing something obvious, the intention is clear and identity was established by using reset link from email.

Please tell what are your thoughts, please tell whether the user should be logged in after resetting the password?

Related: Should confirm email links autologin if the user is not logged in? (my answer would be yes)

7
  • I don't see the problem. Remember, they are users and can do whatever they like and not only the steps you pave out for them. You have to be flexible. Why wouldn't you like when somebody doesn't log in immediately after requesting a new password? Put a time limit on the link, or a amount of requests/day if you like.
    – Dirk
    May 29, 2013 at 8:07
  • As you've suggested, there is a very closely related question to this one. What is it that differs your question from that one, as they appear to be both covering the same ground?
    – JonW
    May 29, 2013 at 8:30
  • I agree that these two are closely related. Reason for differentiating - here are two possible workflows: 1) I just want create an account and access it later 2) As an online marketeer I would like to receive their onboarding emails as reference material. Remember: users and can do whatever they like (via @Dirk) May 29, 2013 at 10:01
  • 1
    I think this question should also be asked on security.stackexchange.com since it has security implications as well. Having the question on both the UX and security boards would let us see the issue from both perspectives.
    – Kevin
    May 29, 2013 at 17:11

6 Answers 6

48

No. While it seems to be annoying, I see four problems with not having to enter the login information again:

  1. I will remember my new password better if I have to type it once more. (I keep forgetting my new e-banking password because I don't have to re-enter it, and I of course don't store it in the browser.)
  2. If I want to store the password, the browser PW manager is sometimes confused by the PW change and is not able to treat it properly; this is not the case when I enter a different PW into the standard login form
  3. Having to use the password is the best way to make oneself sure that the password has been really changed.
  4. (security) IMHO it's better when a user logs in only by LOG IN button and never by anything else like CHANGE PASSWORD button.
14
  • 3
    I would give three -1 for the options 1, 2 and 4, as I completely disagree, but the 3rd option is so brilliant, that in summary I give +1 :)
    – Voitcus
    May 29, 2013 at 10:44
  • @Voitcus They all are my opinions. However, as well, I was unhappy about 2 "yes" answers being here with a "no" answer missing that would state the counter-arguments.
    – yo'
    May 29, 2013 at 10:54
  • The big security concern here is if the reset isn't handled properly. Let's say for instance if the key used in the URL isn't removed, then if someone got that key from your email, browser cache, or even server log files then they wouldn't need your password to log in. It probably doesn't have much impact on the original question, but just a note for the security.
    – CLo
    May 29, 2013 at 16:18
  • 10
    None of these reasons are good reasons for the user to have to deal with this. 1 is nonsense on a number of levels, 2 is something users shouldn't have to deal with, 3 can be handled much better by just giving proper feedback, and 4 I just totally don't get. May 29, 2013 at 19:22
  • 1
    +1 primarily for #2, I log out then back in just to get Firefox to update it correctly
    – Izkata
    May 30, 2013 at 3:33
41

In my opinion: YES.

The authentication has been done when the password is reset, so the user could be logged in. And it annoys the hell out of me when after password reset I'm not logged in.

I can't think of any case I wouldn't want to be logged in after resetting password, why would I even ask for password reset if I don't want to log in?

4
  • 3
    +1 it annoys the hell out of me (I was wondering if it is only me, glad I'm not alone) May 29, 2013 at 10:02
  • +1 I agree it is a bit of a hindrance when completing all the steps and your presented with the log-on screen. May 29, 2013 at 11:38
  • Yes - If there exists a history where auto re-logging in has caused significant problems, then I would say no. But the no reasons tend to fall in the class of "what is best for me" and not what is convenient for me. (First Post) May 29, 2013 at 18:36
  • 1
    Atleast having a "change password and log in" choice would be nice improvement on many cases...
    – Samuel M
    May 30, 2013 at 13:56
9

For the vast majority of situations users should be logged in once they have reset their password. Essentially, once you've authenticated someone enough for them to change a password, you've also authenticated them enough for them to perform the task that they likely wanted to perform.

There are however some relatively rare situations where this isn't feasible:

  • Where you have a username for a system, but it isn't clear which site you need to log into. For example, if you're an accountant and have a username / password for an online accounting system that you use for many clients. Often there will be separate domain names for each client such as client1.accounting.com and client2.accounting.com. Here resetting your password would apply across all related sites, but it isn't clear which site you should log into.

  • If the authentication is handled by a separate system to the the application. It's not that it wouldn't be good UX to do this, just that it may be a large technical headache, and so not considered worth the cost.

2

Why not create two buttons "Change password & Login" and "Just change password"? Having another option doesn't hurt in my opinion.

1

The situation is bit controversial. Actually it depends upon the user's perspective of how the user reacts depending upon the situation.

We can explain the situation by using 2 point of views :

  1. From user's point of view, it is obvious that he/she may think of not entering the password again once he/she changed that. In that case the user may be annoyed and think that re-entering the password will be sheer waste of time. So, it is correct not to enter the password again.

  2. From the technical perspective(especially testing point of view), it may happen that the user might have logged in the account few days back using any other device like mobile,tablets etc.

So, once the password is reset, then the user is again prompted for entering the new password so that the confirmation will be sent to the system as the password is changed. Hence it is required to enter the password again.

0

Enforcing user to re login after changing and resetting password totally disagree with the main point of having the forgot password logic. for example:

  • as a user I don't want to save my password in my mind or anywhere else so I want to use forgot password logic every time I want to login to my account and during that logic I set a totally random password and I don't save it in my mind
  • enforcing me to login after setting new password will put me in a cycle to re reset my password and set a new easy to remember password which put my account in risk if 2FA is not on

based on that scenario developers must not ask users to re login after password reset.

2
  • Do you really use the "forgot password logic" to login into site and services? Clearly the design behind this is at least messed up, I mean, call it "login without password", or "login with email" instead... well, my 2 cents. May 31, 2022 at 11:47
  • this is the reason for having a forgot password logic Jun 1, 2022 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.