Set OTP lifetime for password reset to 1 hour [Updated in Security Center 2.0]
Control the time duration of the link in the password reset email.
The glide.pwd_reset.onetime.token.validity system property makes the link in the password reset email expire after the number of hours specified in the property. The validity time of a password reset token should be kept as short as possible while not disrupting normal user experience
Set the property value to 1 (in hours).
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.pwd_reset.onetime.token.validity |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | integer |
| Recommended value | 1 |
| Default value | 1 |
| Fallback value | 1 |
| Category | Authentication |
| Security risk | - Severity score: 4.6 - CVSS score: Medium - Security risk details: A longer validity time for password reset token gives malicious actors a wider window to perform account takeover if the email with the reset token is leaked or compromised. |
| Dependencies and prerequisites | None |
Parent Topic:Authentication