In a default ASP.NET Core project, why does the "Forgot password" functionality ask for user email twice?

3
votes

In Visual Studio 2017, if you create a new ASP.NET Core Web Application (Razor Pages) configured to use Individual user accounts and Store user accounts in- app, the "Forgot password" flow is as follows.

  1. User goes to login page
  2. User click "Forgot your password?"
  3. User enter email address and click "Submit"
  4. An email is sent to the user with a link to reset password. This link contains the user id (Guid), and a code used for reset.
  5. User click link and is taken to the "Reset password" page.
  6. User enter Email, Password and Confirm password and click Reset.

Password is then reset.

My question is if there is some specific reason the user is requested to enter his email in step 6, considering that the user id is already in the URL. The reset password page could look up the user by the id and not ask for the email address.

I assume it's a security-feature, in case someone intercepts the link. But intercepting the link would likely mean intercepting the email containing the link, and then the users email would be known anyway. So I feel like I am missing something.

1
asp.netasp.net-coreidentityforgot-password
That is a design decision by the creators of the template. You can easily create the desired feature yourself of looking up the email. I personally think that including the email or id leaks information. That is however just my opinion. Overview of ASP.NET Core Security - Nkosi

1 Answers

1
votes

Sounds like a security issue to me.

Even though you could look up the user id, show them their email and that would be a better user-experience; it's slightly more secure to have the user enter his/her email again with the code for reset. This way the password reset still contains something you know and something you have to authenticate the user during the password reset process. The something you know is the email address, the something you have is the reset code (and possibly the user id).

If email is not required, and an attacker somehow got a hold of the reset password information but didn't know the user's email address, the attack would be able to use the guid & reset code to reset the password.

If email is required and the attacker does not know the email address then the attacker wouldn't be able to reset the password with just the reset information (user id/code).

Password reset, isn't really used that often and doesn't really have to be the most user-friendly part of your website. Better to be more secure.