---
title: "Verify an expired reset link cannot change a password"
description: "Open a deliberately expired recovery link and verify clear failure, unchanged credentials, and a usable route to request a fresh reset message."
canonical_url: "https://vostride.com/agent-library/account-recovery/expired-reset-link.md"
md_url: "https://vostride.com/agent-library/account-recovery/expired-reset-link.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify an expired reset link cannot change a password

Open a deliberately expired recovery link and verify clear failure, unchanged credentials, and a usable route to request a fresh reset message.

## Risk

Expiry handling must protect the account while helping its owner recover. A form rendered from an expired token is not inherently a failure, but accepting a new password from it violates the required expiration boundary.

## Fixtures

- A test-owned account with a known current credential and a dedicated test inbox.
- A supported fixture that creates or advances one reset token beyond the documented expiry.
- A read-only recovery-state hook that reports token status and credential-version changes without returning token material.

## Steps

1. Request a reset message, isolate the run-specific link, and use the fixture to place that token beyond its validity window.
2. Open the expired link and verify an expired-link explanation or submit the form if the product validates expiry only on submission.
3. Attempt replacement with a fixture password and verify the application refuses completion and offers a route to request another link.
4. Inspect account recovery state and verify the credential version did not change; sign in freshly with the original password to prove it still works.
5. Request a fresh reset message from the recovery route and verify the new link reaches a usable reset form for this account.

## Expected results

- An expired token cannot commit a password change.
- Existing valid credentials remain usable after the rejected recovery attempt.
- The error state provides a working recovery route and does not silently reuse the expired token.

## False-pass traps

- The browser clock alone may not control a token whose expiry is enforced by the server.
- Merely seeing an expired label does not prove a subsequent submission was refused.

## Cleanup

- Invalidate unused recovery links and delete run-specific inbox messages.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)