SigNoz/signoz · error · errors.Error

ErrCodeResetPasswordTokenExpired

ErrCodeResetPasswordTokenExpired

Error message

reset password token has expired

What it means

The supplied password-reset token exists in the store but its expiration timestamp has passed. Returned as TypeUnauthenticated from VerifyResetPasswordToken when resetPasswordToken.IsExpired() is true.

Source

Thrown at pkg/modules/user/impluser/getter.go:145

	return module.userRoleStore.GetUserRoleByOrgIDAndID(ctx, orgID, id)
}

func (module *getter) GetResetPasswordTokenByOrgIDAndUserID(ctx context.Context, orgID valuer.UUID, userID valuer.UUID) (*types.ResetPasswordToken, error) {
	return module.store.GetResetPasswordTokenByOrgIDAndUserID(ctx, orgID, userID)
}

func (module *getter) GetUsersByOrgIDAndRoleID(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID) ([]*types.User, error) {
	return module.store.GetUsersByOrgIDAndRoleID(ctx, orgID, roleID)
}

func (module *getter) VerifyResetPasswordToken(ctx context.Context, token string) error {
	resetPasswordToken, err := module.store.GetResetPasswordToken(ctx, token)
	if err != nil {
		return err
	}

	if resetPasswordToken.IsExpired() {
		return errors.New(errors.TypeUnauthenticated, types.ErrCodeResetPasswordTokenExpired, "reset password token has expired")
	}

	return nil
}

func (module *getter) OnBeforeRoleDelete(ctx context.Context, orgID valuer.UUID, roleID valuer.UUID, _ string) error {
	users, err := module.GetUsersByOrgIDAndRoleID(ctx, orgID, roleID)
	if err != nil {
		return err
	}
	if len(users) > 0 {
		return errors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasUserAssignees, "role has active user assignments, remove them before deleting")
	}
	return nil
}

View on GitHub (pinned to 5069bf80b0)

Solutions

  1. Request a new password reset token (restart the forgot-password flow)
  2. Check/increase the reset token TTL configuration if users routinely exceed it
  3. Ensure server clocks are in sync (NTP) so tokens don't appear expired prematurely
Defensive patterns

Strategy: try-catch

Try / catch

err := verifyResetPasswordToken(ctx, token)
if err != nil && errors.Ast(err, errors.TypeUnauthenticated) && strings.Contains(err.Error(), "expired") {
    // prompt user to request a new reset email
}

Prevention

When it happens

Trigger: Calling the verify-reset-password-token endpoint (or ResetPassword flow) with a token older than the configured TTL; reusing a token from an old email after it expired.

Common situations: User waits too long before clicking the reset link; token was generated by an older deployment with different TTL; clock skew between services.

Related errors

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/f35c3c9c34eed4c7. Report an issue: GitHub.