<div dir="ltr">2-3 days for email verification seems OK to me, but I wouldn't do that for password resets. So I think you need to request a feature to be able to configure those independently.</div><div class="gmail_extra"><br><div class="gmail_quote">On 10 November 2015 at 13:50, Libor Krzyzanek <span dir="ltr"><<a href="mailto:lkrzyzan@redhat.com" target="_blank">lkrzyzan@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
we got requirement to have long timeout e.g. 2 - 3 days on links for e-mail verification during registration for better UX.<br>
It’s possible to do it via setting "Login action timeout” to 3 days. This setting also change the timeout of link for forgot password AFAIK.<br>
<br>
I’m thinking about security implications.<br>
<br>
Can somebody steal such link in e-mail somehow and then steal identity because of doing “forgot password” on target account? For example by listening SMTP protocol communication?<br>
<br>
Thanks,<br>
<br>
Libor Krzyžanek<br>
<a href="http://jboss.org" rel="noreferrer" target="_blank">jboss.org</a> Development Team<br>
<br>
<br>
_______________________________________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></blockquote></div><br></div>