20

I'm running in this issue for two separate accounts:

I would use the "Forgot your password?" link on login.salesforce.com to request a password reset link to be sent to my email.

However, every time I click on the password reset link in my email, I see "Your reset link expired after 24 hours or has already been used."

This has been going on for weeks and I can't help but wonder if this is a glitch on Salesforce's end. What is going on?

Improve this question
3
  • What was the solution for this? I have the same problem now. It just loops back to the same message: 'Your reset link expired after 24 hours or has already been used.'
    – jonnygold1
    Apr 8, 2017 at 9:04
  • @Regnarg Have you found any solution for this? We are also facing the same issue.
    – Rajendra Rathore
    May 24, 2017 at 3:59
  • @Rajendra I think what happened was that the account that I was trying to access was one that has been deactivated. I was mistakenly trying to gain access to an acccount that I was no longer given access to, if I recall correctly.
    – PuffySparrow
    May 25, 2017 at 6:07

13 Answers 13

Reset to default
12

There's a Salesforce Knowledge article about this. It is caused, as other posters have said, by the email server protection software. Salesforce lists Mimecast, McAfee's 'Link Protect' feature, Covenant Eyes and all versions of Outlook. If you go to any profile, scroll down to System and select Password Policies. In here, there is a check box you can tick to not expire the password immediately in 'forgot password' emails. This bypasses the email server protection tools, and should then allow the links to work.

Knowledge Article: https://help.salesforce.com/articleView?id=000333308&type=1&mode=1

Profile-based Password Policies

Improve this answer
1
  • 1
    This is correct and should be pursued before anything else.
    – Rick Schmidt
    Mar 12, 2021 at 19:04
8

For those who are experiencing this issue on Outlook, if the URL as presented by Outlook begins with something like https://nam02.safelinks.protection.outlook.com/?url=<escaped_sfdc_url>, then you may be able to do this, which worked for me:

  1. Copy the full URL (Careful not to accidentally click it!)

  2. In a browser developer console window, type:

    window.open(unescape('<copied_url>'))

    But DON'T PRESS RETURN yet

  3. Delete everything in the copied URL up to (and including) url=

  4. Press Enter

This should open a new window on Salesforce where the link is not expired.

Improve this answer
3
  • PS: I find that EVERYTHING about Salesforce is as hard as it can possible be. I posted the above instructions to their "Trailhead" community, and it is not possible to edit a post—or even to delete one's own post. Although their UI provides numbered lists, they are not numbered. Infuriating from start to finish.
    – Dave Land
    Mar 12, 2021 at 18:30
  • 1
    Thanks this solved it
    – Swapnadip
    Nov 7, 2022 at 10:40
  • not seeing url= on my sf reset links...
    – chomp
    Sep 13 at 13:16
6

Is your email going through a virus scanner that checks links within emails for malware etc. ? The password reset link you are being sent expires as soon as the link is visited.

Having an admin send you a password reset link will most likely work as it uses a different format for the token and the link does not expire until the password is actually reset or 24 hours, whichever comes first.

Improve this answer
3

Recently I've faced the same issue. Every time I clicked on the password reset link in my email from Outlook office, I saw

"Your reset link expired after 24 hours or has already been used.".

Once I unchecked "Try the new Outlook" checkbox, the next Salesforce reset link was valid. I have no idea what's wrong with the new style of outlook office but the issue was resolved in my case.

Improve this answer
1

Raise a case. That sounds odd.

The only time I've experienced that is if I've accidentally clicked "Send new password" or whatever twice in a row for the same user.

I assume that isn't what you've been doing, so it feels like a problem at the Salesforce end.

Improve this answer
1

I was having this problem using Outlook web version on Office.com. What worked for me was getting a new link sent and then opening the email on my Android phone using the Outlook app and clicking the link from there.

Improve this answer
0

For Mimecast you can add an exception: 1. Go to Mimecast.com administration console 2. Go to Monitoring -> URL Protection 3. Locate the password reset email. I believe if you right click on that email you can add an exception to allow future emails with links from this address to go through properly.

Improve this answer
7
  • What the heck does Mimecast have to do with this?
    – Eric
    Jun 19, 2018 at 3:46
  • 1
    Mimecast is checking all email hyperlinks inside a sandbox for malicious activity. Password reset links that are designed to be clicked only once and then expire, are then no longer valid once Mimecast checks the hyperlink.
    – joshgoldeneagle
    Jun 20, 2018 at 17:00
  • so you are saying that all salesforce users have access to mime cast which salesforce provide and somehow can manage the reset email link
    – Eric
    Jun 20, 2018 at 23:26
  • For people that run Salesforce and an email security product such as Mimecast, Proofpoint or similar product, your email security product may be causing the issue. That's the bottom line. If you do not have an email security product, you may have an antivirus or other product that is possibly interfering with the link (by design).
    – joshgoldeneagle
    Jun 21, 2018 at 23:49
  • 1
    It's quite possible this is the cause. I've just stumbled upon this myself and the issue was Mimecast clicking links before I had the chance to click them. Not specifically Mimecast but any software that auto clicks email links could be the cause. I fail to see how this isn't a relevant suggestion.
    – Henders
    Aug 29, 2019 at 9:53
0

I've been facing the same issue. I have opened my mail in chrome browser(not in app) and right click on reset link -> open link in new tab. This has worked for me.

Improve this answer
0

https://help.salesforce.com/s/articleView?id=000332248&type=1 We had this issue in our org. Completely turning off safelinks is an obv security risk, salesforce assistance was not very helpful. With the knowledge article I linked, our infrastructure team was able to whitelist the domains where password reset links originate.

In our instance, no checkboxes fixed the issue because safelinks was touching the reset email before it arrived in the inbox.

Now we've got the same issue again because the prod env was successfully whitelisted BUT a sandbox env resides elsewhere and emails from salesforce's other IP range(s) haven't been whitelisted.

Good luck

Improve this answer
0

I hope that this helps:

  1. Copy link from email
  2. Go to http://www.o365atp.com/
  3. Paste the Safelink in the first box
  4. Copy link from the second box
  5. Paste it in your browser
Improve this answer
0

This issue happens due to office outlook trying to verify if the link is safe. When the link is received in the email do not click on it. 1.Go to url decoder - https://www.urldecoder.org/ 2.Paste the password reset link from the email. 3.Delete beginning part from copied url upto (and including) ?url= for example: https://nam10.safelinks.protection.outlook.com/?url= then click on decode 4. Use the new decoded link to reset the password

Improve this answer
1
  • 1
    This seems to be very similar to a few existing answers.
    – Derek F
    Sep 13 at 0:34
0

If using outlook on desktop. Simply copy the link text to notepad. Do not click the link. Open a browser (perhaps a private one just to be safe). Then copy the link in manually and press enter. This bypasses the safe link mechanism outlook will perform.

This is presuming that your link looks something like:

https://xxx.my.salesforce.com/secur/forgotpassword.jsp?r=

This should work. The key is not to execute the link from anything Outlook related, be it the desktop or web version then it should be ok.

Improve this answer
-2

This issue happening mostly in outlook. If you are having the same issue follow the below steps for resolution

  1. Call Salesforce toll free number and ask them to send a reset link to your registered email
  2. Open your registered email and click the link to change password
  3. If the step2 is not working then open your registered email and forward the reset link email to your personal email
  4. Now open your personal email and click the link to change your password.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .