Authentication-related features about flaredown HOT 4 CLOSED

@safeforge on both the Password Reset and Change Password forms, I am able to put different emails into the "password" and "confirm password" fields without error. It seems to take the "password" field in that case.

I also think that it might be best to send a reset link via email even for users who are already logged-in, so that someone couldn't steal an account and then change the password to lock the real owner out. What do you think?

And as a small thing -- let's change it to "new password" so the user knows it's not asking for their current password.

from flaredown.

I also think that it might be best to send a reset link via email even for users who are already logged-in, so that someone couldn't steal an account and then change the password to lock the real owner out. What do you think?

my feeling is to ask the current password for logged user. it's more simple to implement and it's a very common security system

from flaredown.

@safeforge ok, let's do that!

from flaredown.

👍

from flaredown.