Introduction
Spearphishing emails with dangerous links are legitimate concerns for many organizations including Compliance and its customers. Many IT departments deploy URL rewriting software to identify and "quarantine" potentially dangerous URLs, but sometimes the rules behind these security suites are overly aggressive and break otherwise safe and important URLs such as those required for password reset flows.
Compliance Password Reset and URL Rewriting
If the links included in Compliance's password reset emails are modified in any way, it can cause the user to be stuck in a "loop" where they are unable to successfully complete the reset process.
When conducting a password reset, the URL included in the email should be in the following format:
https://api.threatswitch.com/v1/auth/password/edit.[ID]?reset_password_token=[token]&config=default
Any deviation from the password reset format will cause a password loop. Companies using email security tools that adjust links will need to whitelist Compliance.
Outlook ATP Safelinks
If using Outlook ATP Safelinks, policies need to be updated in order for links to come through without modification. If password reset emails are being modified by Safelinks, the URL string will be preceded by: https://nam04.safelinks.protection.outlook.com/?
IT Teams will need to add a whitelist policy to their ATP Safelinks for the domain: threatswitch.com. Please see the relevant 365 support article for more information.
Note: Threatswitch was the previous name of the platform and is still being used in certain areas, including email domains.
It is recommended to use a generic wildcard format around threatswitch.com to ensure that all ThreatSwitch links function.
Mimecast URL Protect
Mimecast's URL protect rewrites certain URLs which can send users into a password reset link. A Mimecast URL policy needs to be added whitelisting Threatwitch.
General Troubleshooting
If you have encountered a password reset loop and have remedied it but are still having issues, or are generally having difficulties with password resets read below.
Password reset security considerations to know:
Password reset URLs contained in Compliance's password reset emails expire after 1 hour.
Password reset urls are "one time use". If a url was used previously, even in an unsuccessful password reset attempt, a user will need to initiate another password reset flow from the password reset page.
Cookies must be enabled for the threatswitch.com domain otherwise the password confirmation process cannot proceed and will result in an error message.