[wp-trac] [WordPress Trac] #32429: Password reset links should expire

[WordPress Trac]

#32429: Password reset links should expire
--------------------------+------------------------------
 Reporter:  markjaquith   |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Security      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |     Focuses:
--------------------------+------------------------------

Comment (by nacin):

 Our naming convention for filters in this area is all over the place:
  * auth_cookie_expiration
  * nonce_life
  * wp_feed_cache_transient_lifetime
  * oembed_ttl
  * post_password_expires

 I would suggest, instead of time_to_expire_password_keys, something like
 password_reset_expiration.

 I don't think $time needs to appear in the link itself, nor should it be
 set into the cookie. It's not user input; it's for validation on the
 backend. We should be able to contain the logic in
 `check_password_reset_key()`.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/32429#comment:7>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform