Question

我们重新树立了一个特点,使用户能够在无法利用其账户时重新撰写其密码。我们要求他们的电子邮件地址(他们用来向现场进行伐木),寄给他们一个具有独特联系的电子邮件。

问题是:

Should the link expire on first-click or should the link expire on first-use (ie, they reset their password successfully)?
Should the link have 24 hour validity (or something similar)?
Should the user be logged in after he clicks that link?

Answer 1

The link should expire after they have reset their password successfully. If somehow the user ended up needing guidance on a password reset and wanted to return later, they should be able to.
That being said the reset should expire eventually, 48 hours?
Yes they should be logged in after a password reset, otherwise there is another frustrating step in the way of your user doing what they came to do on your site.

Answer 2

链接应在密码改动后到期。如果你在第一次点击线上过期,这会造成问题。我要说的是,我是坏的互联网连接,而一页的 did子完全是我的浏览器。我重新上下页,说链接已经过期。我很高兴看到这一点。
是的,你应当把这一联系限制在一段合理的时间。 24小时看得足够合理。如果你不限制联系寿命,首先,你必须永远储存所生成的补贴,其次,你将这种联系维持得越长,袭击者越有可能偷窃这种联系,从而导致偷窃账户。
You should let user in only after user changes his/her password. If you just log them in, they probably will decide that they don t have to change password anymore. This way they can keep logging into the system forever without ever changing/knowing their password.