Secure Password Reset
Categories
Component ID
2675876
Component name
Secure Password Reset
Component type
module
Maintenance status
Development status
Component security advisory coverage
not-covered
Downloads
218
Component created
Component changed
Component body
The Forgot Password feature of core can be used to gather information such as valid usernames. Then these information may be used to perform brute force attack or account lockout attack(DoS).
This module addresses this by giving the same message for both Valid/invalid username/email Id.
Overview:
Makes password reset form more secured by not disclosing valid usernames
Installation:
1. Copy the secure_password_reset directory to the Drupal sites/<...>/modules/ directory.
2. Go to "Administer" -> "Modules" and enable the module.
Thats all there is to it, the password reset form should now give the user the same message in both cases of valid or invalid username