I'm using EE 2.7.3 and would like to know if it's possible to increase the default expiration time (24 hours) on the outgoing link in the reset password routine.

Any help much appreciated.



No, that is not configurable. Typically, 24 hours should be sufficiently long, and any longer would start to introduce security issues. The user triggering the action is doing so to reset their password now, not some time in the future (or shouldn't be, anyway).

If an active code were to sit in their inbox for many days, for instance, that increases the chance that someone with access to that email (shared account, walking away from a desk, etc.) could intentionally or accidentally reset their password and gain control of their account.

  • That's a lot for that Derek - makes a lot of sense! Jul 21 '14 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.