Should admin users confirm their password before changing a user password?

Question

In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their current password when doing so.

Admin users can change the password of any user. Should they be required to confirm their password when doing so?

Answer 1

This is an anti-pattern of least privilege principle. In common case, a "reset password" button should be enough, which will lead a target user to password reset form.

But if you need exactly "set new password" button, then you shold consider two relevant attack vectors - CSRF and XSS. If you'll mitigate them well - that should be pretty enough without additional authentication.

Answer 2

Admin users can change the password of any user. Should they be required to confirm their password when doing so?

The website could prompt the admin user for his password on each setting change including password reset for normal user.
Regardless of this policy being good or bad, you want just confirm that the right user is performing admin tasks, this is different for normal user case where the purpose of requesting current password is to make sur the right user has access to right account.

Answer 3

Probably not beneficial to make them re-enter their password for an action like resetting a user password - you already made the admin user authenticate to your system. You could make every user enter their password for every possible action and it would be “more secure,” but not meaningfully so. Additionally, resetting a password is not an especially sensitive action for an admin user to take (not like deleting a resource, for example)

Assuming you are already properly authenticating the admin user in the first place, and that you are protecting from other cross site attacks, this would only really address two scenarios

1. Your website doesn’t automatically log out users, and an admin user logged on the left their workstation available for another person to physically hijack - an extra password check would mitigate this (admittedly unlikely) vulnerability. You should be automatically logging users off at regular intervals of inactivity anyway, particularly privileged users.
2. You want to make the admin consider carefully if they actually want to perform the reset - analogous to deleting a repository on GitHub it a virtual machine in Azure where you have to type the name of the resource you’re trying to delete. Resetting a password is typically not as big of a deal as deleting resources though, so this also seems not very beneficial compared to the hassle for the admin users.

Not much benefit in any case. You would be better served by making sure things like two-factor authentication work and protecting against cross site attacks.