Wednesday, 11 September 2013

Best practice - 'forgotten username' process

Best practice - 'forgotten username' process

I've currently been asked to implement a 'forgotten username'
functionality on a site I've inherited, and I'm curious what the best
practice is for the process. I'm already following best practice for
resetting the user's password (by sending an expiring, one use reset link)
- but there doesn't seem to be any best practice policy for a forgotten
username.
The options I've seen on other sites are:
1 Input email address and send it - this is the most straightforward, but
I'm uncomfortable about sending the username to the email address.
2 Input email address and send a single use, expiring link which displays
the username - but after it's expired or been used, it obviously won't
work anymore.
3 Similar to 3, but merge it with the change password process - if the
user forgets their username, they get to see their username, but they have
to reset their password too.
The user table doesn't have any other info set up within it (security
question, date of birth, etc) - so I can't ask for any of this information
without adding it retrospectively. But I'd appreciate any advice or views
others have on how they have either implemented it, or how they think it
should be implemented :).

No comments:

Post a Comment