The immortal reset link
A customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.
This answers: How long should a password reset link last? No coding needed. 3 quick decisions.
- Who is signed in
- Keeping data safe
Checking your access…
How long should a password reset link last?
A reset link should expire after a short time, often 15 to 60 minutes, work only once, and be cancelled when a newer link is requested. After the password changes, sign out other sessions and email the owner. Tokens must be long and random. A link that never expires turns every old email into a working key.
Breaks at Your server: Reset token never expires
Why AI tools write this bug
AI-generated reset flows often store a token and check it exists, without an expiry time, a used flag, or cancelling older tokens.
How to fix it
- Add an expiry time to every reset token.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Should a reset link sign the user in automatically?
- It is safer to let them set a new password and then sign in, so the link only does one thing.