Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
It mentioned that password reset link should be single use and expire after appropriate period. I don't understand why should it be single use?
Also found this: https://www.troyhunt.com/everything-you-ever-wanted-to-know/
Finally, we want to ensure that this is a one-time process. Once the reset process is complete, the token should be deleted so that the reset URL is no longer functional. As with the previous point, this is to ensure an attacker has a very limited window in which they can abuse the reset URL.
So the whole point of being "single use" and "time-limit" is to limit the window... but if the time limit is fairly short (eg: 30 minutes), is it okay for the link to not be single use? Is this another security vs convenience topic, or is there any reasons why it must be single use that I am not aware of?
I'm new in this section of SE (and to security in general), so if mod thinks there are better tags, feel free to change it.
