adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[users] reset password workflow #2126

New Issue
Closed
opened 2026-10-05 01:07:06 +02:00 by adam · 0 comments
adam commented 2026-10-05 01:07:06 +02:00
Owner
Copy link
Copy source

Following a meeting with plg, we realized that the current password reset workflow has become unnecessarily complicated after the recent security fixes.
Right now, Piwigo requires two emails (one with a verification code and another with a reset link), but the link should not be mandatory anymore since we already have a secure 6-digit TOTP-style verification code that is valid for 15 minutes and limited to 3 attempts.

We agreed on the following improvements to simplify and secure the workflow:

  • If the user has the status guest or generic, block the password reset immediately, without sending or asking for a verification code.
  • The verification code must be a 6-digit numeric code.
  • Limit to 3 attempts to enter the verification code.
  • Add a lockout mechanism after failed attempts: store userprefs.reset_password_forbidden_until (timestamp) and block reset attempts for 1 hour.
  • Write an entry in the activity table for each verification attempt.
  • Piwigo must send a confirmation email after a successful password change, and if the user has active API keys, include an extra sentence recommending to revoke them.
Following a meeting with _plg_, we realized that the current password reset workflow has become unnecessarily complicated after the recent security fixes. Right now, Piwigo requires two emails (one with a verification code and another with a reset link), but the link should not be mandatory anymore since we already have a secure 6-digit TOTP-style verification code that is valid for 15 minutes and limited to 3 attempts. We agreed on the following improvements to simplify and secure the workflow: - If the user has the status guest or generic, block the password reset immediately, without sending or asking for a verification code. - The verification code must be a 6-digit numeric code. - Limit to 3 attempts to enter the verification code. - Add a lockout mechanism after failed attempts: store `userprefs.reset_password_forbidden_until` (timestamp) and block reset attempts for 1 hour. - Write an entry in the activity table for each verification attempt. - Piwigo must send a confirmation email after a successful password change, and if the user has active API keys, include an extra sentence recommending to revoke them. <!-- github-sync-id:3634989968 -->
adam closed this issue 2026-10-05 01:07:06 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#2126