21

I'm running in this issue for two separate accounts:

I would use the "Forgot your password?" link on login.salesforce.com to request a password reset link to be sent to my email.

However, every time I click on the password reset link in my email, I see "Your reset link expired after 24 hours or has already been used."

This has been going on for weeks and I can't help but wonder if this is a glitch on Salesforce's end. What is going on?

Improve this question
3
  • What was the solution for this? I have the same problem now. It just loops back to the same message: 'Your reset link expired after 24 hours or has already been used.'
    – jonnygold1
    Commented Apr 8, 2017 at 9:04
  • @Regnarg Have you found any solution for this? We are also facing the same issue.
    – Rajendra Rathore
    Commented May 24, 2017 at 3:59
  • @Rajendra I think what happened was that the account that I was trying to access was one that has been deactivated. I was mistakenly trying to gain access to an acccount that I was no longer given access to, if I recall correctly.
    – PuffySparrow
    Commented May 25, 2017 at 6:07

16 Answers 16

Reset to default
14

There's a Salesforce Knowledge article about this. It is caused, as other posters have said, by the email server protection software. Salesforce lists Mimecast, McAfee's 'Link Protect' feature, Covenant Eyes and all versions of Outlook. If you go to any profile, scroll down to System and select Password Policies. In here, there is a check box you can tick to not expire the password immediately in 'forgot password' emails. This bypasses the email server protection tools, and should then allow the links to work.

Knowledge Article: https://help.salesforce.com/articleView?id=000333308&type=1&mode=1

Profile-based Password Policies

Improve this answer
1
  • 1
    This is correct and should be pursued before anything else.
    – Rick Schmidt
    Commented Mar 12, 2021 at 19:04
13

For those who are experiencing this issue on Outlook, if the URL as presented by Outlook begins with something like https://nam02.safelinks.protection.outlook.com/?url=<escaped_sfdc_url>, then you may be able to do this, which worked for me:

  1. Copy the full URL (Careful not to accidentally click it!)

  2. In a browser developer console window, type:

    window.open(unescape('<copied_url>'))

    But DON'T PRESS RETURN yet

  3. Delete everything in the copied URL up to (and including) url=

  4. Press Enter

This should open a new window on Salesforce where the link is not expired.

Improve this answer
4
  • PS: I find that EVERYTHING about Salesforce is as hard as it can possible be. I posted the above instructions to their "Trailhead" community, and it is not possible to edit a post—or even to delete one's own post. Although their UI provides numbered lists, they are not numbered. Infuriating from start to finish.
    – Dave Land
    Commented Mar 12, 2021 at 18:30
  • 1
    Thanks this solved it
    – Swapnadip
    Commented Nov 7, 2022 at 10:40
  • 1
    not seeing url= on my sf reset links...
    – chomp
    Commented Sep 13, 2023 at 13:16
  • 1
    Alternatively, you can use urldecoder.org or another decoder.
    – Mitch
    Commented Sep 16 at 18:51
6

Is your email going through a virus scanner that checks links within emails for malware etc. ? The password reset link you are being sent expires as soon as the link is visited.

Having an admin send you a password reset link will most likely work as it uses a different format for the token and the link does not expire until the password is actually reset or 24 hours, whichever comes first.

Improve this answer
3

Recently I've faced the same issue. Every time I clicked on the password reset link in my email from Outlook office, I saw

"Your reset link expired after 24 hours or has already been used.".

Once I unchecked "Try the new Outlook" checkbox, the next Salesforce reset link was valid. I have no idea what's wrong with the new style of outlook office but the issue was resolved in my case.

Improve this answer
2

I was having this problem using Outlook web version on Office.com. What worked for me was getting a new link sent and then opening the email on my Android phone using the Outlook app and clicking the link from there.

Improve this answer
1
  • Thanks - this was the only solution that worked for me today
    – BritishBoyinDC
    Commented Aug 29 at 13:17
0

Raise a case. That sounds odd.

The only time I've experienced that is if I've accidentally clicked "Send new password" or whatever twice in a row for the same user.

I assume that isn't what you've been doing, so it feels like a problem at the Salesforce end.

Improve this answer
0

For Mimecast you can add an exception: 1. Go to Mimecast.com administration console 2. Go to Monitoring -> URL Protection 3. Locate the password reset email. I believe if you right click on that email you can add an exception to allow future emails with links from this address to go through properly.

Improve this answer
7
  • What the heck does Mimecast have to do with this?
    – Eric
    Commented Jun 19, 2018 at 3:46
  • 1
    Mimecast is checking all email hyperlinks inside a sandbox for malicious activity. Password reset links that are designed to be clicked only once and then expire, are then no longer valid once Mimecast checks the hyperlink.
    – joshgoldeneagle
    Commented Jun 20, 2018 at 17:00
  • so you are saying that all salesforce users have access to mime cast which salesforce provide and somehow can manage the reset email link
    – Eric
    Commented Jun 20, 2018 at 23:26
  • For people that run Salesforce and an email security product such as Mimecast, Proofpoint or similar product, your email security product may be causing the issue. That's the bottom line. If you do not have an email security product, you may have an antivirus or other product that is possibly interfering with the link (by design).
    – joshgoldeneagle
    Commented Jun 21, 2018 at 23:49
  • 1
    It's quite possible this is the cause. I've just stumbled upon this myself and the issue was Mimecast clicking links before I had the chance to click them. Not specifically Mimecast but any software that auto clicks email links could be the cause. I fail to see how this isn't a relevant suggestion.
    – Henders
    Commented Aug 29, 2019 at 9:53
0

I've been facing the same issue. I have opened my mail in chrome browser(not in app) and right click on reset link -> open link in new tab. This has worked for me.

Improve this answer
0

https://help.salesforce.com/s/articleView?id=000332248&type=1 We had this issue in our org. Completely turning off safelinks is an obv security risk, salesforce assistance was not very helpful. With the knowledge article I linked, our infrastructure team was able to whitelist the domains where password reset links originate.

In our instance, no checkboxes fixed the issue because safelinks was touching the reset email before it arrived in the inbox.

Now we've got the same issue again because the prod env was successfully whitelisted BUT a sandbox env resides elsewhere and emails from salesforce's other IP range(s) haven't been whitelisted.

Good luck

Improve this answer
0

I hope that this helps:

  1. Copy link from email
  2. Go to http://www.o365atp.com/
  3. Paste the Safelink in the first box
  4. Copy link from the second box
  5. Paste it in your browser
Improve this answer
0

This issue happens due to office outlook trying to verify if the link is safe. When the link is received in the email do not click on it. 1.Go to url decoder - https://www.urldecoder.org/ 2.Paste the password reset link from the email. 3.Delete beginning part from copied url upto (and including) ?url= for example: https://nam10.safelinks.protection.outlook.com/?url= then click on decode 4. Use the new decoded link to reset the password

Improve this answer
1
  • 1
    This seems to be very similar to a few existing answers.
    – Derek F
    Commented Sep 13, 2023 at 0:34
0

If using outlook on desktop. Simply copy the link text to notepad. Do not click the link. Open a browser (perhaps a private one just to be safe). Then copy the link in manually and press enter. This bypasses the safe link mechanism outlook will perform.

This is presuming that your link looks something like:

https://xxx.my.salesforce.com/secur/forgotpassword.jsp?r=

This should work. The key is not to execute the link from anything Outlook related, be it the desktop or web version then it should be ok.

Improve this answer
0

I have solved it by changing the method with which I reset the password.

Before I used: Site.forgotPassword And now: System.resetPasswordWithEmailTemplate

The link no longer expires

Improve this answer
0

If you are experiencing this issue on Outlook and the URL in the password reset email looske something like this with https://###02.safelinks.protection.outlook.com/?url=<escaped_sfdc_url>, then the following steps worked for me

  1. Copy the password reset link in outlook (don't click)
  2. Use this website to decode the URL https://www.umsystem.edu/forms/safe-link-decoder
  3. Copy the decoded URL to your browsers address bar and continue with password reset steps
Improve this answer
1
  • 1
    This question already has quite a few answers—including one that the community has extensively validated. Are you certain your approach hasn’t been given previously? If so, it would be useful to explain how your approach is different, under what circumstances your approach might be preferred, and/or why you think the previous answers aren’t sufficient. Can you kindly edit your answer to explain?
    – Tushar Jadav
    Commented Oct 17 at 12:22
-1

To bypass the initial Safelink check and ensure that the password reset link sent via email works, you can try the following steps:

Inspect the Safelink URL:

When you receive the password reset email, right-click on the link and select “Copy link address” (or a similar option). Paste the link into a text editor or a safe environment where you can examine it closely.

Remove Safelink Prefix:

Safelinks typically have a prefix (e.g., https://safelinks.protection.outlook.com/...). Remove the Safelink prefix from the URL, leaving only the original link intact.

The resulting link should directly point to the password reset page. Manually Open the Modified Link: Paste the modified link (without the Safelink prefix) into your web browser’s address bar.

Press Enter to open the link.

This should take you directly to the password reset page. Remember that bypassing Safelinks may expose you to potential security risks, so proceed with caution. If possible, consult your organization’s IT department or security team for guidance on handling password reset links.

Improve this answer
1
  • 1
    I appreciate your interest in contributing to the community. This question already has quite a few answers—including one that the community has extensively validated. Are you certain your approach hasn’t been given previously? If so, it would be useful to explain how your approach is different, under what circumstances your approach might be preferred, and/or why you think the previous answers aren’t sufficient. Can you kindly edit your answer to explain?
    – Tushar Jadav
    Commented Jul 18 at 4:17
-2

This issue happening mostly in outlook. If you are having the same issue follow the below steps for resolution

  1. Call Salesforce toll free number and ask them to send a reset link to your registered email
  2. Open your registered email and click the link to change password
  3. If the step2 is not working then open your registered email and forward the reset link email to your personal email
  4. Now open your personal email and click the link to change your password.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .