title: Time limited, or one time use, password reset tokens?
body: <p>Users forget passwords, and (nearly) all membership sites need a way to help users get back in.</p>
  
  <p>I'd like to implement the common scenario:</p>
  
  <ol>
  <li>User hits site, tries to log in, can't, and realizes they forgot password - crap!</li>
  <li>User enters email address and clicks "forgot password"</li>
  <li>User gets email with a password reset link</li>
  </ol>
  
  <p>Here's how I'm planning to implement this (C#/ASP.NET MVC):</p>
  
  <ol>
  <li>When the user enters email and hits "forgot password" button my site will generate a GUID, store it on the member's entity in the DB (<code>member.ResetToken</code>), and email them a link with that GUID in the url (the email sent will inform them they can use this link to one time only)</li>
  <li>User clicks the link and my site looks up their account based on that <code>member.ResetToken</code> from the url. If their account is found show them a password reset form, and when they complete the reset it clears the <code>member.ResetToken</code> from their account.</li>
  </ol>
  
  <p>Here's my question: keep it like this (in which they can reset their password with that link at any time, now or in the future) or add a timestamp to limit how long they have to reset their password?</p>
  
  <p>From a UX perspective the ability to reset your password whenever you're ready is great, but I want to make sure I'm not overlooking some security issues this could raise.</p>