JuniorCase studyRequirements
Write a user story with acceptance criteria for password reset
Try answering first
Model answer
Story. As a registered user who forgot my password, I want to reset it using my email, so that I can regain access to my account.
Acceptance criteria (Given/When/Then):
- Given a registered email, when I request a reset, then a reset link is emailed and the page shows a neutral confirmation.
- Given an unregistered email, when I request a reset, then the page shows the same neutral confirmation, so account existence is not revealed.
- Given a valid link, when I submit a new password that meets the password policy, then my password is changed and I can sign in with it.
- Given an expired or already used link, when I open it, then I see an error and an option to request a new link.
- Given a successful reset, then existing sessions are signed out and a notification email is sent.
Keep the story small, and put the link lifetime and password policy in the criteria or as linked NFRs.
Key points
- Story format: As a <role>, I want <goal>, so that <benefit>
- Acceptance criteria cover the happy path and failure cases
- Do not reveal whether an email is registered
- Cover link expiry and single use
Likely follow-ups
- How would you split this story if it is too large?
- What non-functional requirements belong to this feature?
Common mistakes
- Describing only the happy path
- Writing implementation details instead of observable behavior
- Making criteria vague, such as "works correctly"