Automatic login on password reset

Question

This question has been raised on https://security.stackexchange.com/questions/40723/why-do-you-need-to-login-after-you-change-a-password - With security in mind

As one user states: "From a security point of view, whether the "password reset" logs you in automatically or not is rather neutral."

So why do we enforce the user to re-type the same email and password just provided by the user?

Reset password:

Email -> Unique token -> Set a new password -> Redirect to login page -> Type in email again -> Type in password again -> Log in user

instead of

Email -> Unique token -> Set a new password -> Log in user

Answer 1

Now that I know it isn't for any security reason, I'll fall back on the reason being tradition, ignorance, and laziness.

Okay, maybe someone thought if you make the user enter the password again (possibly the third time after entering it twice to reset it), the user is more likely to remember it. I don't know if that is really a net gain for the user or not. I'd guess not.

But, no, I suspect tradition, ignorance, and laziness. Not every design is for a reason. Sometimes the "designer" is just being mindless, then other designers mindlessly copy it.

One system I use displays a "password reset successfully" page after you reset it... and nothing else. No login page. Not even a link to a login page. The user has to click Back repeatedly to find the login page. The whole app is rife with UX WTFs like that.