I'm building a new web site.  I'm now writing the code where a user can request an email to reset a lost password.  As I'm writing it, it occurs to me that there could be several scenarios:The user simply forgot their password and needs a reset, so it doesn't matter if I let the old password be valid.  A hacker got into the user's email account and has requested a password reset from my site, so it's best to leave the old password valid for a few days so the user can get back into the account and alert a mod.The user's password is compromised and needs it changed immediately, so letting the old password be valid risks letting unauthorized persons into the account.What is the solution to this dilemma?
When a user changes their password, should I let the old password be valid for a few days?
password
You should change the password immediately. There are several reasons for this:If the account has been compromised allowing the old password will mean that the account is still compromised and the attacker will be able to change it again.Every other system changes the password immediately, so this is what the user will be expecting.If you allow the old password the user might not think that the password has in fact been changed so may well initiate the change password procedure again.All changes for a password should be confirmed via an e-mail sent to the registered address and as long as you don't allow a change of password and a change of contact e-mail address at the same time then the it should be difficult for an attacker to gain control over the account.You would only allow the change when the user visits the page you link to in the e-mail or allow the change to be rejected via a link.