Best practice for resetting emails and passwords

Rails
1

Users login into my app with their email and password. When they want to
change these their details do should i send a “change xxxx request link”
via email to their registered address for either a password or email
change request?

Somesites allow user to edit it there and then, some send links for for
one and others for both.

Whats considered best practice?

2

thanks very much for your response. Re: the later part of your response,
i also thought if a user can log into their own account then they have
done enough to proove they are who they are and should be able to change
their details without the need for email verification.

However after some manual checking, some sites such as this one require
email verification so I thought id ask here.

Many Thanks

Adam

3

Adam A. wrote:

Users login into my app with their email and password. When they want to
change these their details do should i send a “change xxxx request link”
via email to their registered address for either a password or email
change request?

Somesites allow user to edit it there and then, some send links for for
one and others for both.

Whats considered best practice?

There’s not necessarily a best practice as there are advantages for both
methods. For example, the user has decided to change his email and/or
password and has access to his inbox of the address that is currently in
use on your site - in this scenario, I would send a link to change the
email and/or password for security. An argument against this would be if
the user no longer has access to that email account, it would be
impossible to change there details.

It wouldn’t be illogical to assume there is a User area on your site? If
so, it can be argued that adding an email and/or password changing field
in here is secure enough; if the user has gained access to his/her
account, this should warrant giving them the ability to amend their
details.

I hope this helps.

4

Adam A. wrote:

thanks very much for your response. Re: the later part of your response,
i also thought if a user can log into their own account then they have
done enough to proove they are who they are and should be able to change
their details without the need for email verification.

However after some manual checking, some sites such as this one require
email verification so I thought id ask here.

Many Thanks

Adam

It depends on the security level you want for your site. But the main
factor I would consider would be how many users your site is expecting
to have. The more users the site has, the more security issues there are
bound to be. Therefore, tighter security is required.

I hope this helps.