Skip to main content
IPA1-Visitor
1-Visitor
Mar 8, 2018 3:30 PM UTC
Question

Reset Password AppKey-Token Clean-up

Hi,

 

my question is concerning the built-in "Reset Password" mechanism that is available through the Form Login page of an Organization. Every time a user resets her password a new application key ("<username>resetToken") is created.

 

Question: Does this application key continue to exist forever on the platform or is there some built-in mechanism (e.g. scheduler) that automatically deletes these resetToken-appkeys?

5 replies

supandey5-Regular Member
5-Regular Member
Mar 15, 2018 2:39 PM UTC

Hi @IPA since it expires after a certain period, my understanding is that it gets cleaned up automatically i.e. if it has expired.

 

Is there any specific use case around this topic? Are you observing something odd?

Translate
IPA1-VisitorAuthor
1-Visitor
Mar 16, 2018 12:50 PM UTC

Hi @supandey, you mean that there is some sort of internal scheduler that checks if the app keys has expired and if yes, it deletes them (and i mean completely delete the app key entity)? I did not see this happening.

 

The use case is that if users start resetting their passwords and the reset tokens are not cleaned up the platform will eventually get full of expired, not needed app keys, which of course require disk space. I do not think this is a good practice..

Translate
supandey5-Regular Member
5-Regular Member
Mar 16, 2018 1:06 PM UTC

Expired token is deleted, whenever the next time user attempts to reset password for the associated account. So it should not stack up bunch of expired tokens.

Translate
Terms & ConditionsAccessibility statement