Set OTP lifetime for password reset to 12 hours or less [Updated in Security Center 2.0]

Control the time duration of the link in the password reset email.

This property makes the link in the password reset email expire after the number of hours specified in the property passed. The validity time of a password reset token should be kept as short as possible while not disrupting normal user experience.

More information

AttributeDescription
Configuration name glide.pwd_reset.onetime.token.validity
Configuration type System Properties (/sys_properties_list.do)
Data type integer
Recommended value 12
Default value 12
Category Authentication
Security risk
  • Severity score: 5.6
  • CVSS score: Medium
  • Security risk details: Having a long validity time for the password reset token increases the chance of a bad actor performing an account takeover.
Dependencies and prerequisites None