theonedev/onedev · error · ExplicitException

Password reset url is invalid or obsolete

Error message

Password reset url is invalid or obsolete

What it means

PasswordResetPage.onInitialize validates the password-reset request token loaded from the URL. If the token is absent, expired, or already used, the page throws ExplicitException('Password reset url is invalid or obsolete') instead of showing the reset form, because reset links are single-use and time-limited.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/security/PasswordResetPage.java:181

						user.setPasswordResetCode(null);
						user.setPassword(OneDev.getInstance(PasswordService.class).encryptPassword(bean.getNewPassword()));
						getUserService().update(user, null);
						Session.get().success(_T("Password changed. Please login with your new password"));
						setResponsePage(LoginPage.class);
					}
				};
				form.add(BeanContext.edit("editor", bean));
				form.add(new Link<Void>("cancel") {

					@Override
					public void onClick() {
						setResponsePage(LoginPage.class);
					}

				});
				fragment.add(form);
			} else {
				throw new ExplicitException(_T("Password reset url is invalid or obsolete"));
			}
		}  
	}
	
	private UserService getUserService() {
		return OneDev.getInstance(UserService.class);
	}
	
	@Override
	protected String getTitle() {
		if (passwordResetCode == null)
			return _T("Forgotten Password?");
		else 
			return _T("Enter New Password");
	}

	@Override
	protected String getSubTitle() {

View on GitHub (pinned to d44925c47c)

Solutions

1. Request a new password reset email and use the newest link immediately, once.
2. Paste the full URL, ensuring the entire token parameter is intact.
3. If resets repeatedly fail, ask an admin to reset your password directly in user management.
4. Check server time/NTP if links seem to expire instantly.

if (passwordResetRequest == null) { /* treat link as obsolete, offer new reset */ }

try {
  openResetPage(token);
} catch (ExplicitException e) {
  // show 'request new reset link' form
}

When it happens

Trigger: Opening a reset link whose token no longer resolves to a valid pending password-reset request — link already used once, link expired, password-reset record cleared, or the token parameter was truncated when copying the URL.

Common situations: Clicking a reset email link a second time; requesting a new reset (invalidating the old link) then using the older email; corporate mail scanner pre-fetching links; copy/paste losing part of the token.

Related errors

• Authentication required
• Unauthenticated
• Not authenticated
• Unable to import build spec (import project: {0}, import rev
• Invalid access token

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/7f28409007fb605e. Report an issue: GitHub.