I'm working on a financially leaning site and was curious — is there a standard amount of time to wait before expiring a reset password link once a user has forgotten his/hers and requested to reset it?
On the other hand, if there is no "standard" as such, how might a UX practitioner go about figuring out what would be a sensible and acceptable period for their use case?
The closest thing to a standard that I found is the OWASP Forgot Password Cheat Sheet, which says:
no more than 20 minutes or so
There doesn't appear to be a standard.
https://postmarkapp.com/guides/password-reset-email-best-practices has a password email reset guide that includes this information:
Expiration information
If the link expires—and it should—include a sentence to let the recipient know that it expires and how long until the link expires. And, for convenience, include a direct link to where they can initiate another password reset request if the link has expired.
Well-engineered password reset processes will automatically expire or invalidate the password reset URL after a period of time. In some cases, the expiration window may be aggressive, and it’s possible the link will expire before the recipient has an opportunity to check their email and reset their password. So it’s important to clearly communicate both the fact that the link expires as well as when the link will expire.
I think it depends on the use case. If someone is reseting their password and wants access right then, a shorter expiration time would make sense.
If someone is sending password reset emails that may or may not be used immediately, a longer reset time would be useful to the user.
Generally when users initiate a password reset, they're actively in the process of trying to get into their account. I would set the link expiration between 30-60 minutes, and insert a message letting the user know when the link will expire and have instructions on how they can re-engage the process again if they need a new link.
However there is an approach where you could use a generic forgot password link for all users and wouldn't need to worry about link expiration at all. Since there are some security issues that arise when you provide a user specific link, you could have all users visit a forgot password page where they have to answer specific challenge and security questions before proceeding to the password reset screen. With this method you reduce the risk of a user's account being compromised if that same user's email account has also been compromised. This approach is outlined in this PDF file.
The longer is expiration time, the higher is the probability, that somebody else accesses this link. That's why the expiration time should be relative short.
Keep in mind that the Email (SMTP) server that you use may send Emails not immediately, but after some delay. Also the Email client of your user may have some delays between checking the server. So I recommend expiration time between 10 min and 1 hour.
I think 24 hours is a user-friendly (ie, convenient) time limit. It's easy to remember if you're the requesting party and it gives you plenty of time.
As someone who has done a fair bit of security compliance, I can say the answer is: ask your company's compliance officer.
Probably more important than setting the reset-window time, is ensuring your ping their SMS or other '2nd factor' when resetting. This is important in case someone else is trying to reset to break in. Consider that you can ping their 2nd factor (e.g. SMS) interactively, so that if they respond with 'freeze', or similar, then then you can immediately disable the password reset code.
20-minute resets are generally safe, though be mindful of whether your email deliverablity is good enough for them to get it in that window of time.
presume shorter time windows for financial logins, business SaaS, and similar critical systems. The same goes for social accounts if the account is 'high status' or the request comes from outside the normal activity profile.
