Challenge 2 / 2

After a successful reset, we log the user in ourselves - no password prompt, no login form:

$this->addFlash('success', 'Your password has been reset, you are now logged in!');
$security->login($user);

Why is it OK to skip the login form here?

It isn't really OK - but the session is discarded on the next request, so the risk window is tiny.

login() only grants IS_AUTHENTICATED_REMEMBERED, so anything sensitive will still ask for the password.

The reset token counts as a credential of its own, so Symfony marks the session as authenticated whether we call login() or not.

To get this far, they clicked a link emailed to their own address - proving they control that inbox - and then chose the new password themselves. There's nothing left for a login form to verify.

Rewatch the video