# Best practice for resetting emails and passwords

**URL:** <https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851>\
**Category:** Rails\
**Created:** [December 5, 2009, 9:14am UTC](https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851 "2009-12-05T09:14:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![scudco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/aca169/32.png) [@scudco](https://www.ruby-forum.com/u/scudco)\
**Post date:** [December 5, 2009, 9:14am UTC](https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851/1 "2009-12-05T09:14:30Z")

</div>

Users login into my app with their email and password. When they want to  
change these their details do should i send a “change xxxx request link”  
via email to their registered address for either a password or email  
change request?

Somesites allow user to edit it there and then, some send links for for  
one and others for both.

Whats considered best practice?

---

<div class="post-metadata">

**Author:** ![scudco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/aca169/32.png) [@scudco](https://www.ruby-forum.com/u/scudco)\
**Post date:** [December 6, 2009, 12:19pm UTC](https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851/2 "2009-12-06T12:19:28Z")

</div>

thanks very much for your response. Re: the later part of your response,  
i also thought if a user can log into their own account then they have  
done enough to proove they are who they are and should be able to change  
their details without the need for email verification.

However after some manual checking, some sites such as this one require  
email verification so I thought id ask here.

Many Thanks

Adam

---

<div class="post-metadata">

**Author:** ![scudco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/aca169/32.png) [@scudco](https://www.ruby-forum.com/u/scudco)\
**Post date:** [December 5, 2009, 10:16am UTC](https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851/3 "2009-12-05T10:16:52Z")

</div>

Adam A. wrote:

> Users login into my app with their email and password. When they want to  
> change these their details do should i send a “change xxxx request link”  
> via email to their registered address for either a password or email  
> change request?
> 
> Somesites allow user to edit it there and then, some send links for for  
> one and others for both.
> 
> Whats considered best practice?

There’s not necessarily a best practice as there are advantages for both  
methods. For example, the user has decided to change his email and/or  
password and has access to his inbox of the address that is currently in  
use on your site - in this scenario, I would send a link to change the  
email and/or password for security. An argument against this would be if  
the user no longer has access to that email account, it would be  
impossible to change there details.

It wouldn’t be illogical to assume there is a User area on your site? If  
so, it can be argued that adding an email and/or password changing field  
in here is secure enough; if the user has gained access to his/her  
account, this should warrant giving them the ability to amend their  
details.

I hope this helps.

---

<div class="post-metadata">

**Author:** ![scudco](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/aca169/32.png) [@scudco](https://www.ruby-forum.com/u/scudco)\
**Post date:** [December 7, 2009, 10:19am UTC](https://www.ruby-forum.com/t/best-practice-for-resetting-emails-and-passwords/179851/4 "2009-12-07T10:19:04Z")

</div>

Adam A. wrote:

> thanks very much for your response. Re: the later part of your response,  
> i also thought if a user can log into their own account then they have  
> done enough to proove they are who they are and should be able to change  
> their details without the need for email verification.
> 
> However after some manual checking, some sites such as this one require  
> email verification so I thought id ask here.
> 
> Many Thanks
> 
> Adam

It depends on the security level you want for your site. But the main  
factor I would consider would be how many users your site is expecting  
to have. The more users the site has, the more security issues there are  
bound to be. Therefore, tighter security is required.

I hope this helps.