Should the user's password field be included (with all the hassle) on the settings page?

Question

What is the best implementation of changing user settings with respect to the password change?

I have a rails app, and if a user goes to the "update profile" page, the password field has to be re-entered every time even if the user is going there simply to change their address or job title or whatever.

Might 2 pages be better? One for updating the users profile, and another for the users password. It seems like overkill to have a completely separate page for changing the password.

Answer 1

This depends on the level of security you require. Perhaps you can conditionally require the password depending on which fields the user has altered?

Answer 2

Neither approach

If possible, settings should be on one page, and you should not have to re-enter your password.

There are several ways to do this. Here are two:

In the second approach, the password form is hidden and is displayed when the user wants to change the password.