I want to change the one-time login URL, which is the link being sent to the user in order to reset his password.
I want to make it smaller and not have the random letters in its URL.
Is this possible? Where can I change this?
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.Sign up to join this community
It is possible to do that, but you definitely shouldn't do it.
The "random characters" are there for security purposes. Without them, it would be easier to reset passwords of other users, including the super administrator (uid: 1) for example. The hashes in URL are also longer in order to prevent collisions and make it harder for others to guess.
Password reset URLs are time-sensitive and expire after 24 hours (by default) if not used. Here is the breakdown of the password reset URL:
user_pass_rehash()to understand this better if you want.
All of this was made so your users and your site would be more secure.
If you want to fully understand how this process works, open the
/modules/user/user.pages.inc file, and check specifically the
user_pass_reset() function. That function is responsible for validating the request, and allowing the users to reset their password.
Hope this makes sense; I wrote it pretty fast but it should cover the main points.