Northgate: password reset links say 'expired' the moment people open them
Description
Since last week our office staff click the password reset link a minute after the email arrives and get "This link has expired or was already used". Our IT changed the mail filter on the 12th, if that matters.
Linked issues
- relates to ENG-1448 Password reset links say 'expired' before people open them (mail scanners use them up) Done
Comments (5)
Yes, the GET uses up the token. Their scanner gets there first. Logged ENG-1448: GET shows the form, the token is used only when the new password is posted.
Hi Rachel, it matters: your new mail filter opens every link in incoming mail to check it, and our reset link counted that as its one use. We're changing that so only setting the new password uses the link. Until then, your IT could exclude our sender from link scanning, or we can send a fresh link and the person clicks it straight away.
ENG-1448 deployed. The invitation link had the same problem; fixed too.
Hi Rachel, fixed: reset links and invitation links now survive your mail filter. Closing.
Marek, Northgate reset links come up 'already used'. Their new mail filter probably opens links to scan them. Does a GET use our token?