Does the login-link users receive upon registration actually expire?

Question

I'm trying to expand the duration for the expiration of the one-time-login for the initial registration process:

• the user clicks on "create new account"
• after filling name and email and sending the request, user gets a notification with one-time-link

I have changed the duration of 'password_reset_timeout' with

drush config:set user.settings password_reset_timeout 100

to 100 sec for testing purposes. But the link does not expire after the set time...

When I use the "Reset your password" option and receive the one-time login, the message on the page shows the expiration date, but this isn't shown on the login page with the registration link.

So, does the registration one-time-link ever expire?

Answer 1

Nope, new users' one-time-link do not expire. Only "forgot passwords"-links do.

Also, see this discussion. It might come in future Drupal 9 releases. https://www.drupal.org/project/drupal/issues/3097238