Direct answer
A recovery token grants a sensitive account action. Check its validity period, intended account and reuse behavior using a dedicated user and an inbox controlled by the assessor.
Set up a safe account
Create a disposable account with a controlled mailbox and agree the expected token lifetime and single-use policy. Use only the application's supported recovery workflow; do not capture production users' links or passwords.
Reference: OWASP Forgot Password Cheat Sheet.
Verify the normal recovery
Request a recovery message and complete the action once using a test password. Confirm the legitimate user can sign in with the new password and that the previous password no longer works. Protect the entire recovery URL as a secret.
- Record request and redemption times without the token value.
- Check the notification or audit event where promised.
- Reset the account safely between cases.
Test reuse and expiry
Repeat the used link and verify it cannot perform another reset. Request a new link and, after the documented lifetime, try it against the same test account. If a new request should invalidate an earlier link, verify that rule separately.
Retest after a fix
Repeat the valid, used and expired cases after changes and confirm normal recovery remains possible. Review whether old sessions are invalidated according to the application's policy, and report any untested identity provider behavior.
Assessment limits
Token handling varies by provider and recovery method. One test account cannot prove every delivery channel, administrator reset or federated login is protected.
Frequently asked questions
Does an expired link mean all sessions have ended?
No. Token expiration and existing-session revocation are separate controls.
Why avoid including the full link in evidence?
A valid recovery URL can allow a sensitive account action. Record a redacted identifier and timing instead.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.