3 ms·
Shouldn't this risk be mitigated with authorization rules? Or do we assume we are delivering pages without any type of auth first?
by sopooneo 10y ago
Shouldn't this risk be mitigated with authorization rules? Or do we assume we are delivering pages without any type of auth first?
- dennisgorelik 10y agoYou should allow to reset password to the users without authentication (and therefore without authorization). That's the nature of password reset link.
- sopooneo 10y agoOh of course. Good point.