Why password reset links must be signed, single-use, and time-limited

A password-reset link stayed valid for eleven days after the user had already changed their password, because the service embedded an unsigned user ID and timestamp in the URL. Anyone who saw that link, through a shared screen, screenshot, or browser history, could reset the account. The article argues that such links act as bearer credentials and must be unforgeable, time-bounded, and spendable only once. It presents a versioned, HMAC-signed token design in Python to meet these requirements. It also covers attack vectors such as replay, key compromise, leakage through logs and referrer headers, and error-message oracles.