Expired Token Handling
Verify that expired verification/reset tokens are properly rejected with a helpful message guiding users to request a new one.
Preconditions
- You have an old password reset or verification email with an expired link
- Or you can wait for a token to expire (usually 1-24 hours)
Test Data
To test: request a password reset, wait for expiration period (check with dev team for exact time), then try to use the link.Test Steps
Follow each step carefully
Find an old/expired verification or password reset email
Check old emails or wait for a fresh token to expire
Token expiration times vary: usually 24 hours for verification, 1-24 hours for password reset
Click the link in the expired email
The verification or reset link
Link opens in browser
Observe the system response
Page loads and displays a message
Expected Result
Proper handling: (1) Clear error message: "This link has expired" or "Invalid or expired token", (2) Helpful guidance: "Request a new verification/reset link", (3) Easy way to request a new link (button or link provided), (4) No partial actions taken - token either works completely or fails completely.
Ready to Complete?
Click when you have verified all steps and the expected result.
Test Info
- Module
- Authentication
- Steps
- 3
- Duration
- 3 min
- XP Value
- +20