I'm using EE 2.7.3 and would like to know if it's possible to increase the default expiration time (24 hours) on the outgoing link in the reset password routine.
Any help much appreciated.
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.Sign up to join this community
No, that is not configurable. Typically, 24 hours should be sufficiently long, and any longer would start to introduce security issues. The user triggering the action is doing so to reset their password now, not some time in the future (or shouldn't be, anyway).
If an active code were to sit in their inbox for many days, for instance, that increases the chance that someone with access to that email (shared account, walking away from a desk, etc.) could intentionally or accidentally reset their password and gain control of their account.