Can PASSWORD_RESET_TIMEOUT_DAYS in Django be set to .5 days or hours?

Question

I'm using Django's built-in Reset Password Views. As the title says, I wonder if I can set the PASSWORD_RESET_TIMEOUT_DAYS to half days (for example 1.5)?

If not, I guess I could extend and customize the Django auth view that makes use of this variable, but I have not been able to trace which one that would be?

Answer 1

If we inspect the source code of the PasswordResetTokenGenerator on GitHub (Djang-2.1), we see:

# Check the timestamp is within limit. Timestamps are rounded to
# midnight (server time) providing a resolution of only 1 day. If a
# link is generated 5 minutes before midnight and used 6 minutes later,
# that counts as 1 day. Therefore, PASSWORD_RESET_TIMEOUT_DAYS = 1 means
# "at least 1 day, could be up to 2."
if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS:
    return False

So the current day, as well as the timestamp (ts), we see that these are integer that calculate the number of days. The self._num_days(..) [GitHub] is calculated as:

def _num_days(self, dt):
    return (dt - date(2001, 1, 1)).days

So both are specified in "full days" since January 1, 2001. You can specify the number as a float, but it will not work, since the difference at the left side of the equation, only changes after one day, hence 0.5 or 1 is here the same.

Since according to the documentation of PASSWORD_RESET_TIMEOUT_DAYS [Django-doc]:

The minimum number of days a password reset link is valid for. Depending on when the link is generated, it will be valid for up to a day longer.

This setting thus acts as a discrete variable with as unit a day. Furthermore as we can see, the number of days is "quantized", which means that it can in reality result in 23 hours, 59 minutes, etc. extra.

Answer 2

in Django version > 3.0 PASSWORD_RESET_TIMEOUT_DAYS has been deprecated. and now in the latest version it supports reducing the value of this timeout, so we can reduce it to the number of seconds a password reset link is valid for.

in your settings.py you can configure the same like below

PASSWORD_RESET_TIMEOUT = 259200 # Default: 259200 (3 days, in seconds)

for more info - https://docs.djangoproject.com/en/3.1/ref/settings/#password-reset-timeout