ACME HQDemo work items and pages, made up for Emargen's demo. Not a real company.
Engineering / ENG-1448

Password reset links say 'expired' before people open them (mail scanners use them up)

Project
Engineering
Type
Bug
Status
Done Done
Priority
High
Organization
Northgate
Reporter
Marek Nowak <marek.nowak@acme-hq.example>
Assignee
Marek Nowak <marek.nowak@acme-hq.example>
Labels
northgatesign-in
Components
identity-service
Fix versions
identity-service 2026.05.22
Sprint
Sprint 42
Created
19 May 2026, 09:40 UTC
Updated
22 May 2026, 08:20 UTC
Resolved
22 May 2026, 08:20 UTC

Description

Northgate (SUP-859): reset links are "expired or already used" when people click them, minutes after the email.

Northgate's mail filter opens every link in incoming mail to scan it. Our reset link uses up the token on the GET.

Steps to reproduce

  1. Ask for a reset. Before clicking, curl the link once.
  2. Click the link.

Expected: the reset form. Actual: "This link has expired or was already used."

Fix

GET shows the form and doesn't touch the token. The token is used only when the new password is posted.

Linked issues

Comments (1)

Marek Nowak ยท 22 May 2026, 08:20 UTC

Deployed. The welcome-email link had the same problem; fixed too.