{"record":{"id":"df78fe628c01dfdd","repo":"SigNoz/signoz","slug":"errcoderesetpasswordtokenexpired-df78fe","errorCode":"ErrCodeResetPasswordTokenExpired","errorMessage":"reset password token has expired","messagePattern":"reset password token has expired","errorType":"error_code","errorClass":"errors.Error","httpStatus":401,"severity":"error","filePath":"pkg/modules/user/impluser/setter.go","lineNumber":393,"sourceCode":"\t\t\t\"Link\":   resetLink,\n\t\t\t\"Expiry\": humanizedTokenLifetime,\n\t\t},\n\t); err != nil {\n\t\tmodule.settings.Logger().ErrorContext(ctx, \"failed to send reset password email\", errors.Attr(err))\n\t\treturn nil\n\t}\n\n\treturn nil\n}\n\nfunc (module *setter) UpdatePasswordByResetPasswordToken(ctx context.Context, token string, passwd string) error {\n\tresetPasswordToken, err := module.store.GetResetPasswordToken(ctx, token)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif resetPasswordToken.IsExpired() {\n\t\treturn errors.New(errors.TypeUnauthenticated, types.ErrCodeResetPasswordTokenExpired, \"reset password token has expired\")\n\t}\n\n\tpassword, err := module.store.GetPassword(ctx, resetPasswordToken.PasswordID)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tuser, err := module.store.GetUser(ctx, valuer.MustNewUUID(password.UserID))\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// handle deleted user\n\tif err := user.ErrIfDeleted(); err != nil {\n\t\treturn errors.WithAdditionalf(err, \"deleted users cannot reset their password\")\n\t}\n\n\tif err := user.ErrIfRoot(); err != nil {","sourceCodeStart":375,"sourceCodeEnd":411,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/modules/user/impluser/setter.go#L375-L411","documentation":"UpdatePasswordByResetPasswordToken (the ResetPassword handler) found the token in the store but its TTL has elapsed, so the password cannot be changed with it. Returned as TypeUnauthenticated.","triggerScenarios":"POST to the reset-password endpoint with a token whose created/expired timestamp is in the past; replaying a token from a previous reset email.","commonSituations":"User submits the reset form after the token TTL elapsed; delayed emails; multiple reset requests where the user uses the oldest token.","solutions":["Start a new forgot-password flow to get a fresh token and complete it promptly","Increase the reset-token TTL in config if the window is too short for your users","Make the client submit the reset form immediately after the email arrives and handle 401 by re-requesting"],"exampleFix":"// before\nresetPassword(oldToken, newPassword) // 401 expired\n// after\nnewToken := requestForgotPassword(email) // then\nresetPassword(newToken, newPassword)","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := updatePasswordByResetPasswordToken(ctx, token, newPass)\nif err != nil && types.IsErrCode(err, types.ErrCodeResetPasswordTokenExpired) {\n    token = requestNewToken(email) // retry once with a fresh token\n    err = updatePasswordByResetPasswordToken(ctx, token, newPass)\n}","preventionTips":["Complete the reset immediately after receiving the email","Never reuse tokens from older reset emails"],"tags":["auth","token-expired","password-reset","user-module"],"backgroundTag":"token-expired","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}