Minimize reset password request expiration duration
The password_reset.request.expiry denotes the time period in minutes during which a user must perform the password reset process.
If the password_reset.request.expiry system property is not set to the recommended value of 10 or less, then it increases the opportunity for someone else to guess and use the request and attempt to reset the password.
Ensure that the property password_reset.request.expiry is set to 10 or less.
Note: The setting for thepassword_reset.request.expiry property takes precedence over the setting for glide.pwd_reset.onetime.token.validityproperty that has a 12 hour default.
More information
| Attribute | Description |
|---|---|
| Configuration name | password_reset.request.expiry |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | An integer less than or equal to 10 |
| Default value | <none> |
| Fallback value | 100 |
| Category | Configure Password Reset properties |
| Security risk | - Severity score: 4.2 - CVSS rating: Medium - Security risk details: Short expiration windows are critical to reducing the opportunity for unauthorized password resets and maintaining account security. |
| Functional impact | None |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.
Parent Topic:Authentication