Testing for Password Reset token validation

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQqVxEnnBaHGz4b2wAW8JrNq3dk7K83Se8g59T8-pxhsJbIgpaZnWBnlkPlnRC3IVgko9HL5urGY1Pd0gOPAxa2DHB98WTkYjSxXTun66M_gFTtsjPA5r_scJZ9icIYsZOe7a0jxDED5aU/s1600/RESET-PASSWORD2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQqVxEnnBaHGz4b2wAW8JrNq3dk7K83Se8g59T8-pxhsJbIgpaZnWBnlkPlnRC3IVgko9HL5urGY1Pd0gOPAxa2DHB98WTkYjSxXTun66M_gFTtsjPA5r_scJZ9icIYsZOe7a0jxDED5aU/s1600/RESET-PASSWORD2.png" /></a></div> <br /> Every Web application provides a mechanism to reset our account password.<br /> This generally prompts the user to enter his registered email address to get the password reset link.<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIdvjZ3nKFBTnI709AHeLT_F_WiIb6awkkOIvcfFIlp6ANuDyWE3HJMa-Tl3PmTblp2MyHHLCmzc9PTo96lHNmqomMz7gZ7c2EUJwYnQhW0e3EvXFkFOydh3gZlqCyoNUYFD-gTG_KAOK8/s1600/Forgot+your+password-.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="115" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIdvjZ3nKFBTnI709AHeLT_F_WiIb6awkkOIvcfFIlp6ANuDyWE3HJMa-Tl3PmTblp2MyHHLCmzc9PTo96lHNmqomMz7gZ7c2EUJwYnQhW0e3EvXFkFOydh3gZlqCyoNUYFD-gTG_KAOK8/s320/Forgot+your+password-.png" width="320" /></a></div> Whenever the user enters his registered email address immediately he'll get an email with password reset link from the web application.<br /> <br /> The following are the few ways to test this functionality of that web application,<br /> <br /> <div style="text-align: left;"> Test whether non registered users will also get a password reset links by requesting as a registered user.<br /></div> <div style="text-align: left;"> Registered user gets the reset link, the link contains email. What happens when you change it with other registered email, and also with non registered email. </div> <div style="text-align: left;"> <br />For Example alice has account in http://site.com and  requested password reset she'll get an email like <a href="http://site.com/password_reset?email=alice@gmail.com">http://site.com/password_reset?email=alice@gmail.com</a>. Now test the functionality of web application by entering another email in the above link.</div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> This is very old technique, now a days every one using random token along with the email address in the reset link. One example of such a reset link is </div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYJgjManohATQBndPdfvTZN0-NoY6j1SkiaICwnDK-cCQ9m-gvMtpmS67thiBajaoYinoshSE8DIQLQyLue9EATyFN1S72aGtbzFO-PhnbqTCNdM2sUNk8ntHTPyJ-oUUOebeMWYQbxc0n/s1600/password+reset.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="58" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYJgjManohATQBndPdfvTZN0-NoY6j1SkiaICwnDK-cCQ9m-gvMtpmS67thiBajaoYinoshSE8DIQLQyLue9EATyFN1S72aGtbzFO-PhnbqTCNdM2sUNk8ntHTPyJ-oUUOebeMWYQbxc0n/s640/password+reset.JPG" width="640" /></a></div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> In the above link test whether the email and token are associated or not. If they are not associated you can change the email with another email and can change the password.</div> <div style="text-align: left;"> <br /></div> <div style="text-align: left;"> And latest web applications removed that email field from the reset link, you'll have only reset token.</div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyMME4n09WEZwlss0TRBPmK-n9GFLmyKzbyaIq9u34QvCQKjfi8xXeZ6pcocZ45wzVeAJBxDII_v-Hw7t2X1b_QQeKTanxRnVtkztA02K4eyKX43gBjb5sDvpNRWdWNDXgdNuzsszppuE8/s1600/password+reset1.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="24" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyMME4n09WEZwlss0TRBPmK-n9GFLmyKzbyaIq9u34QvCQKjfi8xXeZ6pcocZ45wzVeAJBxDII_v-Hw7t2X1b_QQeKTanxRnVtkztA02K4eyKX43gBjb5sDvpNRWdWNDXgdNuzsszppuE8/s640/password+reset1.JPG" width="640" /></a></div> <div style="text-align: left;"> <br /></div> </div>

Testing for Password Reset token validation

Every Web application provides a mechanism to reset our account password. This generally prompts the user to enter his registered email...

Read more »