Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There are few kinds of links which validate something. For example when you create an account on a website, that website sends you an activating-link. You have to check your inbox and click on the email to activate your account.
As you know, that email isn't valid forever, it will be expired after a while. Why? What's the benefit of expiring links? In other word, what's wrong with keeping them valid until the user uses them?
[1] Efficiency:
Assuming you issue a new token for each link for every registration attempt, you will end up with a with a number of tokens that you have to keep track for an indefinite amount of times. For practicality terms I would suggest you set a time/date expiration period depending on the nature of your application.
[2] Security:
In the case of password reset function you want fresh tokens to minimise the likelihood of your token to be guessed or stolen by an adversary. Let's say for example we have a web application that issues a 6 digit password reset token that never expires. It will allow an attacker to initiate the password reset process and guess the correct password via bruteforcing all possible combinations. A time/date expiration will significantly minimise the attack window.
Creating a static token that is valid forever is bad practise. For all the reasons stated above depending on the nature of your web application, tokens must be adequately complex, fairly random and valid only for a reasonable amount of time.
The reason activation links for activating a account, is timelimited, is because the resulting account is stored in database for a limited time.
Lets say someone registers a account, but enters a invalid email. Now you have a inactive garbage account lingering around in the database for no apparent reason.
In the cases where the link itself contain all information to perform the action, for example a encrypted link containing all the information entered in the sign-up form, or a 2-step sign-up-proces where user first writes their E-mail, then verify it, and then complete the sign-up with a pre-filled E-mail, those solutions can use links with unlimited validity.
For password resets, the links are usually time-limited for security reasons, as the token can leak out or be compromised if left valid too long. For greylisting reasons and E-mail delivery time reasons, I personally recommend a validity of 72 hours for a submitted email (where you don't know if it has been successfully delivered or not, for example if your webhost have a "smarthost" you need to talk to), and a validity period of 1-6 hours for a mail where you can confirm delivery (eg where you are in direct control of the mail server who talks directly to the receiver's mail server).
