[Bug]: Password reset tokens not invalidated

[AndrolGenhald]

Requirements

• Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support
• Did you check to see if this issue already exists?
• Is this only a single bug? Do not put multiple bugs in one issue.
• Is this a UI / front end issue? Use the lemmy-ui repo.

Summary

Password reset tokens don't currently seem to be expired. They should expire after either first use or after a timeout (say 24h), whichever comes first.

Steps to Reproduce

1. Click forgot password on an instance
2. Use the link to reset your password and it logs you in immediately
3. Log out and use the link a second time, it still works
4. Log out and click forgot password again, but use the first link, it still works

Technical Details

Relevant code is here, here and here. The Crud update implementation for PasswordResetRequest updates an existing request with a new token instead of creating a new one, but it seems to be unused, and a new token is always created but never expired.

Version

0.17.4

Lemmy Instance URL

No response

[AndrolGenhald]

Turns out they are invalidated after 24 hours, but I'm working on making them expire after being used or after a new token is generated.

[dessalines]

Correct, they're invalidated after a day.