Security Cheat Sheets: Password Reset

Translator's comment

We decided to continue translating security cheat sheets from OWASP against the backdrop of massive password recoveries after a database leak at the rzd-bonus.ru service .

Introduction

In order to implement a proper user management system, it usually has a password recovery service that allows users to reset their password if it is lost. Despite the fact that this functionality looks pretty straightforward and simple, it is a common source of vulnerabilities, one of which is username guessing . The following short instructions can be used as a quick reminder in case you lose your password:

• return the same message to both existing and non-existent accounts;

  
  
  
  
  

• make sure that the time it will take to respond to the user is the same;

  
  
  
  
  

• use a third-party channel to reset your password;

  
  
  
  
  

• use URL tokens for simple and fast implementation;

  
  
  
  
  

• make sure the generated tokens or codes are:

  
  
  
  
  

  • ;

    
    
    
    
    

  • ;

    
    
    
    
    

  • ;

    
    
    
    
    

  • .

    
    
    
    
    

  .

  
  
  
  
  

()

, .

, , :

• , ;

  
  
  
  
  

• , , ;

  
  
  
  
  

• , , CAPTCHA, ;

  
  
  
  
  

• , , SQL-, .

  
  
  
  
  

( ) ( SMS), , .

• , ;

  
  
  
  
  

• , , ;

  
  
  
  
  

• , ;

  
  
  
  
  

• , ( !);

  
  
  
  
  

• . , , .

  
  
  
  
  

• , .

  
  
  
  
  

, , , , .

:

• URL;

  
  
  
  
  

• PIN-;

  
  
  
  
  

• ;

  
  
  
  
  

• .

  
  
  
  
  

, , , . , , , .

(, , PIN- . .). , , . :

• ;

  
  
  
  
  

• - JSON (JWT) , ;

  
  
  
  
  

• , ;

  
  
  
  
  

• ;

  
  
  
  
  

• , ;

  
  
  
  
  

• .

  
  
  
  
  

URL

URL- URL- . :

1. URL.

   
   
   
   
   

2. .

   
   
   
   
   

3. Host URL- , HTTP-. URL- , .

   
   
   
   
   

4. , URL- HTTPS.

   
   
   
   
   

5. URL- .

   
   
   
   
   

6. , Referrer-Policy «noreferrer» (. : ), .

   
   
   
   
   

7. , URL-, .

   
   
   
   
   

8. , , .

   
   
   
   
   

9. . , , .

   
   
   
   
   

. URL , PIN, . .

PIN-

PIN- — ( 6 12 ), , SMS.

1. PIN-.

   
   
   
   
   

2. SMS .

   
   
   
   
   

3. PIN , .

   
   
   
   
   

4. PIN- .

   
   
   
   
   

5. PIN-, .

   
   
   
   
   

6. . , , .

   
   
   
   
   

, (, PIN-) . - , , . , .

(, ), . OTP, , .

, (, ). , — Google, GitHub Auth0.

:

• - 8 , 12 - ;

  
  
  
  
  

• , , ( );

  
  
  
  
  

• , ;

  
  
  
  
  

• , .

  
  
  
  
  

, . , .