I'm currently working on a WordPress plugin of my own that involves a custom login interface. I'm wondering, why is it that when you reset your password on WP-Admin, WordPress stores the reset password key in a cookie rather retrieve it from the URL through
For example, if your reset link is
https://example.com/wp-admin/?action=rp&key=123123213213213123&login=admin, the link will store
$_GET['login'] in a cookie and serve you this page using the cookie:
Are there any security reasons for doing that?