Should a user be logged in after resetting their password?
Lets assume following flow:
- I want to log in
- I don't remember password
- I click on the "forgot my password" link (email is dispatched)
- I check my inbox and click on the link
- I type in a new password
- Done
Why, after performing these steps, am I not logged in but instead presented with log-on screen? If we refer back to 1. then it seems obvious that I would like to log in.
Are there any use cases when someone would like to change their password via "forgot my password" link and then not log in? Unless I'm missing something obvious, the intention is clear and identity was established by using reset link from email.
Please tell what are your thoughts, please tell whether the user should be logged in after resetting the password?
Related: Should confirm email links autologin if the user is not logged in? (my answer would be yes)