3 ms·
It's talking about email verification, not password reset systems. In other words, those types of URLs should only establish a connection between an account and
by nbpoole 15y ago
It's talking about email verification, not password reset systems. In other words, those types of URLs should only establish a connection between an account and an email address: they shouldn't act as a means of authentication.
- shabda 15y agoAh ok. Aren't both of these equivalent though? (I would think the point may be that a compromised email, doesn't provide access later. Both these scenario are equally vulnerable then?)
- patrickyeon 15y agoIt would also be to make sure an attacker can't just iterate through or guess at the emailed URLs and get valid, logged-in sessions without needing to properly authenticate.