Should password reset links expire

[Gregoire Detrez]

They tend to accumulate in the roster and it might make sens security wise. What would be a good delay? 48h?

[Evgeny Kotelnikov]

We should also remove the link right after a successful password reset.

[Gregoire Detrez]

It looks like this is already done here

[Gregoire Detrez]

Remove password-resets after 48 hours [fix #103]

Add an in-process task scheduler and use it to remove expired password-reset urls from the database (where expired = older than 48 hours)

→ <<cset 0f13e66a053a>>