Invalid Link The reset password link has either been used before or is invalid (reset passord link)

mohamed-ameer · June 18, 2025, 1:16pm

whenever i try to reset my password via the mail reset passord link
i alwaye get this message
Invalid Link The reset password link has either been used before or is invalid

i tried to increase the “Password Reset Link Generation Limit” and “Reset Password Link Expiry Duratio” from system settings but still not working.

Any sloution?!

update:

After some investigation, I found out that the problem was due to a mismatch between the key in the URL and the stored reset password key in the database .

here is the core code behind it

github.com

frappe/frappe/blob/82f0cc1d09115e84d6acb37fb2b010b2aba69bfc/frappe/core/doctype/user/user.py#L917-L943


      
          def _get_user_for_update_password(key, old_password):
          	# verify old password
          	result = frappe._dict()
          	if key:
          		hashed_key = sha256_hash(key)
          		user = frappe.db.get_value(
          			"User", {"reset_password_key": hashed_key}, ["name", "last_reset_password_key_generated_on"]
          		)
          		result.user, last_reset_password_key_generated_on = user or (None, None)
          		if result.user:
          			reset_password_link_expiry = cint(
          				frappe.db.get_single_value("System Settings", "reset_password_link_expiry_duration")
          			)
          			if (
          				reset_password_link_expiry
          				and now_datetime()
          				> last_reset_password_key_generated_on + timedelta(seconds=reset_password_link_expiry)
          			):
          				result.message = _("The reset password link has been expired")
          		else:

This file has been truncated. show original

When you click on a password reset link like this:

https://your-site.com/update-password?key=some-random-key

Frappe runs the function _get_user_for_update_password(key) which does the following:

Takes the key from the URL.
Hashes it using SHA-256.
Compares the hash with the stored reset_password_key for the user in the database.

If they match, and the key hasn’t expired, the password reset form is shown.

But in my case, the keys didn’t match – because the link was being generated with the wrong base URL.

The system was generating links using an incorrect domain or hostname, while I was trying to use them on a different site.

This happened because the host_name setting in the Frappe site config was not set correctly.

I fixed the issue by updating the host_name in the site config:

bench --site [site-name] set-config host_name https://your-correct-production-domain.com

Then I restarted the services:

#in production (supervisor)
bench restart
#in local environment
Ctrl + c 
bench start