SigNoz/signoz · error · errors.Error

ErrCodeResetPasswordTokenExpired

ErrCodeResetPasswordTokenExpired

Error message

reset password token has expired

What it means

UpdatePasswordByResetPasswordToken (the ResetPassword handler) found the token in the store but its TTL has elapsed, so the password cannot be changed with it. Returned as TypeUnauthenticated.

Source

Thrown at pkg/modules/user/impluser/setter.go:393

			"Link":   resetLink,
			"Expiry": humanizedTokenLifetime,
		},
	); err != nil {
		module.settings.Logger().ErrorContext(ctx, "failed to send reset password email", errors.Attr(err))
		return nil
	}

	return nil
}

func (module *setter) UpdatePasswordByResetPasswordToken(ctx context.Context, token string, passwd string) error {
	resetPasswordToken, err := module.store.GetResetPasswordToken(ctx, token)
	if err != nil {
		return err
	}

	if resetPasswordToken.IsExpired() {
		return errors.New(errors.TypeUnauthenticated, types.ErrCodeResetPasswordTokenExpired, "reset password token has expired")
	}

	password, err := module.store.GetPassword(ctx, resetPasswordToken.PasswordID)
	if err != nil {
		return err
	}

	user, err := module.store.GetUser(ctx, valuer.MustNewUUID(password.UserID))
	if err != nil {
		return err
	}

	// handle deleted user
	if err := user.ErrIfDeleted(); err != nil {
		return errors.WithAdditionalf(err, "deleted users cannot reset their password")
	}

	if err := user.ErrIfRoot(); err != nil {

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Start a new forgot-password flow to get a fresh token and complete it promptly
2. Increase the reset-token TTL in config if the window is too short for your users
3. Make the client submit the reset form immediately after the email arrives and handle 401 by re-requesting

Example fix

// before
resetPassword(oldToken, newPassword) // 401 expired
// after
newToken := requestForgotPassword(email) // then
resetPassword(newToken, newPassword)

err := updatePasswordByResetPasswordToken(ctx, token, newPass)
if err != nil && types.IsErrCode(err, types.ErrCodeResetPasswordTokenExpired) {
    token = requestNewToken(email) // retry once with a fresh token
    err = updatePasswordByResetPasswordToken(ctx, token, newPass)
}

When it happens

Trigger: POST to the reset-password endpoint with a token whose created/expired timestamp is in the past; replaying a token from a previous reset email.

Common situations: User submits the reset form after the token TTL elapsed; delayed emails; multiple reset requests where the user uses the oldest token.

Related errors

• ErrCodeResetPasswordTokenExpired
• CodeUnsupported
• ErrCodeIncorrectPassword
• ErrCodeRoleHasUserAssignees
• ErrCodeUserDeprecated

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/df78fe628c01dfdd. Report an issue: GitHub.