spec 1 linked patterns checked
OWASP Forgot Password Cheat Sheet
Documents forgot-password request handling, consistent response messages and timing, side-channel delivery, cryptographically strong single-use expiring tokens, rate limiting, no automatic login after reset, optional session invalidation, and post-reset notification.
Read with a purpose
What this source can teach
Use this source to check a technical or accessibility requirement against its exact wording and scope.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Password reset | Choose password reset when an unauthenticated or partially authenticated user needs to regain account access by proving control of a recovery channel and setting a replacement password. | Submitting an identifier always leads to the same visible confirmation, regardless of whether an account exists. | OWASP supports neutral reset responses, delivery by email or other side channel, single-use expiring tokens, rate limiting, no automatic login, optional session invalidation, and notifications. |
Comparisons supported by this source
- Password reset vs login vs password creation vs email address entry
OWASP supports consistent forgot-password responses, side-channel delivery, single-use expiring tokens, rate limiting, session handling, and notifications.
Evidence Role
This source is treated as spec evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Cheat Sheet Series. Last checked: .