[sopooneo]

Shouldn't this risk be mitigated with authorization rules? Or do we assume we are delivering pages without any type of auth first?

[dennisgorelik]

You should allow to reset password to the users without authentication (and therefore without authorization).

That's the nature of password reset link.

[sopooneo]

Oh of course. Good point.