3

I want to change the one-time login URL, which is the link being sent to the user in order to reset his password.

I want to make it smaller and not have the random letters in its URL.

Is this possible? Where can I change this?

5

It is possible to do that, but you definitely shouldn't do it.

The "random characters" are there for security purposes. Without them, it would be easier to reset passwords of other users, including the super administrator (uid: 1) for example. The hashes in URL are also longer in order to prevent collisions and make it harder for others to guess.

Password reset URLs are time-sensitive and expire after 24 hours (by default) if not used. Here is the breakdown of the password reset URL:

  • User ID of the member who is trying to reset the password.
  • Timestamp of when the password reset has been requested.
  • Hashed password. This is the element that is checked against the token stored in the database, and verifies that the link is valid. It's a unique hash that is built using the timestamp of when the password reset request has been made, account login information, hashed password and user ID. By doing so, the system makes it almost impossible to generate this information on your own, meaning that only your website is authorized to issue those URLs. And those URLs are issued only if you know the username or email address of an existing account. See the source of user_pass_rehash() to understand this better if you want.

All of this was made so your users and your site would be more secure.

If you want to fully understand how this process works, open the /modules/user/user.pages.inc file, and check specifically the user_pass_reset() function. That function is responsible for validating the request, and allowing the users to reset their password.

Hope this makes sense; I wrote it pretty fast but it should cover the main points.

  • 1
    Wow, immediate and great answer! Thanks a lot! I assume I won't change it then. – Argiris A Mar 15 '16 at 16:16
  • 1
    You're welcome! Glad I helped :) – Aram Boyajyan Mar 15 '16 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.