Reset restores account control and is therefore a security flow, not a minor auxiliary page.
Evaluation approach
Use expiring, single-use evidence bound to the correct account. Avoid unnecessary account enumeration through messages.
Application example
Opening a link on another device should complete the intended reset while preventing reuse.
Limits and considerations
Changing a password does not automatically define what happens to existing sessions.
What happens to existing sessions?
Choose the status of existing devices and refresh authority explicitly. Inform users, and reconsider silent session persistence when compromise is suspected.
Checks and decisions
- Use single-use evidence
- Review old sessions
- Keep responses consistent
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.