Posted on 22/10/2013 12:48:19
Hi Asger,
If you guys are reavaluating things, how about taking into account:
- reset VS recover password - make the user insert a new password generating a unique URL every time the user hits "reset password" (specially for encrypted passwords)
- assign X time for reset, so the user cannot reset the password if he takes a lot of time to do so
Working with Login we also feel the need to:
- authenticate by email, instead of username
- be able to register (update) on multiple websites
- the user does not know website X and website Y belong to the same Dynamicweb solution, and trying to register in the other website, we get the "username already taken" error
Nuno