Every "forgot password" link is a second front door into an account. You can defend the login form perfectly — strong hashing, rate limiting, lockout — but if the reset flow behind that link is weaker, an attacker simply walks through the reset flow instead. The strength of the login no longer matters.
A great many reset flows are guarded only by a security question: "Name of your first pet?", "Your mother's maiden name?", "Your favourite movie?". This is knowledge-based authentication — proving identity with a fact that is supposed to be a secret. The trouble is that these facts are usually not secret:
- They are routinely published on social media and in profiles — discoverable through open-source intelligence (OSINT).
- They come from a small set of likely values, so they can be guessed or brute-forced.
- They cannot be rotated: once your mother's maiden name leaks, it is compromised forever.
A related flaw lives in the change-password feature: an endpoint that lets a logged-in user set a new password but never verifies the current one. That turns a stolen session or a CSRF foothold (cross-site request forgery — a forged request that an attacker-controlled page triggers in the victim's browser without their knowledge) into a full account takeover.
In this lesson you will:
- Understand why security questions are weak authentication, and why a reset flow must be as strong as login.
- See what a secure reset looks like — a single-use, time-limited token sent to a verified channel — and why a change-password endpoint must verify the current password.
- Work through NovaCart's Forgot Password flow against several users, and the Change Password flaw.
- Name the durable replacement for security questions.
Estimated time: 10 to 15 minutes.
Prerequisites: authentication-login for the login attack context, and cross-site-request-forgery before this lesson. The change-password flaw and the quiz questions on session hijacking and forged requests use CSRF terminology directly; without that background those sections will be difficult to follow. A brief inline definition is provided where CSRF first appears, but the full cross-site-request-forgery lesson is the proper foundation.
When you are ready, send the Continue signal.