Timeline for Should password reset link expire when clicked, or wait until reset is filled out and completed?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 3, 2016 at 13:03 | comment | added | crovers | Assuming your reset password page is rate limited and assuming your token space is very large, no. If those things aren't true, you may be opening up for brute force attacks. | |
| Nov 3, 2016 at 8:42 | vote | accept | Roberto14 | ||
| Nov 3, 2016 at 8:36 | vote | accept | Roberto14 | ||
| Nov 3, 2016 at 8:39 | |||||
| Nov 3, 2016 at 8:34 | comment | added | Roberto14 | I do agree #2 is the best option.. is there any issue on validating the token when the user lands on set password webpage? So that if the token is expired we can give feedback right away | |
| Nov 2, 2016 at 15:50 | history | answered | crovers | CC BY-SA 3.0 |