# 'Token expired' while resetting password

**URL:** <https://forums.rocket.chat/t/token-expired-while-resetting-password/15813>\
**Category:** Community Support\
**Created:** [January 20, 2023, 8:49pm UTC](https://forums.rocket.chat/t/token-expired-while-resetting-password/15813 "2023-01-20T20:49:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joshburnett](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/joshburnett/32/4392_2.png) [@joshburnett](https://forums.rocket.chat/u/joshburnett)\
**Post date:** [January 20, 2023, 8:49pm UTC](https://forums.rocket.chat/t/token-expired-while-resetting-password/15813/1 "2023-01-20T20:49:00Z")

</div>

### Description

I have Rocket Chat deployed on a self-hosted server, and generally things are working fine. However, if a user goes through the password reset workflow, they eventually get a ‘token expired’ error and can’t finish the process.

1. User clicks the ‘Forgot your password?’ link on the login screen
2. User enters email in the field and clicks ‘send instructions’
3. User finds the Password Recovery email and clicks the ‘Reset’ button
4. User enters a new password and is prompted for an authentication code in a new email
5. User finds the authentication code from the email and enters it
6. The Authentication Code prompt disappears and the password field now has an error message underneath it that says ‘Token expired’:  
 ![token expired](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/7/73d11df8cdccb7289428fddfdbde8caaaae6cb5b.png)

This happens even when the entire process proceeds quickly without any delays.

### Server Setup Information

- Version of Rocket.Chat Server: 5.4.0
- Operating System: Ubuntu server 22.04 LTS
- Deployment Method: snap
- Number of Running Instances: 1
- DB Replicaset Oplog: ?
- NodeJS Version: v14.19.3
- MongoDB Version: 4.4.15 / wiredTiger (oplog Enabled)
- Proxy: caddy
- Firewalls involved:

### Any additional Information

None; pretty much a vanilla setup.

---

<div class="post-metadata">

**Author:** ![joshburnett](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/joshburnett/32/4392_2.png) [@joshburnett](https://forums.rocket.chat/u/joshburnett)\
**Post date:** [January 21, 2023, 10:23am UTC](https://forums.rocket.chat/t/token-expired-while-resetting-password/15813/2 "2023-01-21T10:23:47Z")

</div>

Checking my logs, I see the following error:

```auto
{
    "level": 50,
    "time": "2023-01-20T20:42:35.212Z",
    "pid": 1091,
    "hostname": "*redacted*",
    "name": "System",
    "msg": "Exception while invoking method resetPassword",
    "err": {
        "type": "errorClass",
        "message": "Token expired [403]",
        "stack": "Error: Token expired [403]<br> at packages/accounts-password/password_server.js:598:15<br> at tryLoginMethod (packages/accounts-base/accounts_server.js:1518:14)<br> at AccountsServer._loginMethod (packages/accounts-base/accounts_server.js:508:7)<br> at MethodInvocation.resetPassword (packages/accounts-password/password_server.js:566:19)<br> at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1885:12)<br> at packages/ddp-server/livedata_server.js:1803:15<br> at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)<br> at packages/ddp-server/livedata_server.js:1801:36<br> at new Promise (<anonymous>)<br> at Server.applyAsync (packages/ddp-server/livedata_server.js:1800:12)<br> at Server.apply (packages/ddp-server/livedata_server.js:1739:26)<br> at Server.call (packages/ddp-server/livedata_server.js:1721:17)<br> at Object.post (app/api/server/v1/misc.ts:612:27)<br> at app/api/server/api.js:463:96<br> at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)<br> at Object._internalRouteActionHandler [as action] (app/api/server/api.js:463:39)<br> at Route._callEndpoint (packages/rocketchat_restivus/lib/route.coffee:150:32)<br> at packages/rocketchat_restivus/lib/route.coffee:59:33<br> at packages/simple_json-routes.js:100:9<br> => awaited here:<br> at Promise.await (/snap/rocketchat-server/1536/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)<br> at Server.apply (packages/ddp-server/livedata_server.js:1752:22)<br> at Server.call (packages/ddp-server/livedata_server.js:1721:17)<br> at Object.post (app/api/server/v1/misc.ts:612:27)<br> at app/api/server/api.js:463:96<br> at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)<br> at Object._internalRouteActionHandler [as action] (app/api/server/api.js:463:39)<br> at Route._callEndpoint (packages/rocketchat_restivus/lib/route.coffee:150:32)<br> at packages/rocketchat_restivus/lib/route.coffee:59:33<br> at packages/simple_json-routes.js:100:9",
        "isClientSafe": true,
        "error": 403,
        "reason": "Token expired",
        "errorType": "Meteor.Error"
    },
    "msg": "Token expired [403]"
}

```

Reformatting that stack trace for easier readability:

```auto
Error: Token expired [403]
    at packages/accounts-password/password_server.js:598:15
    at tryLoginMethod (packages/accounts-base/accounts_server.js:1518:14)
    at AccountsServer._loginMethod (packages/accounts-base/accounts_server.js:508:7)
    at MethodInvocation.resetPassword (packages/accounts-password/password_server.js:566:19)
    at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1885:12)
    at packages/ddp-server/livedata_server.js:1803:15
    at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)
    at packages/ddp-server/livedata_server.js:1801:36
    at new Promise (<anonymous>)
    at Server.applyAsync (packages/ddp-server/livedata_server.js:1800:12)
    at Server.apply (packages/ddp-server/livedata_server.js:1739:26)
    at Server.call (packages/ddp-server/livedata_server.js:1721:17)
    at Object.post (app/api/server/v1/misc.ts:612:27)
    at app/api/server/api.js:463:96
    at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)
    at Object._internalRouteActionHandler [as action] (app/api/server/api.js:463:39)
    at Route._callEndpoint (packages/rocketchat_restivus/lib/route.coffee:150:32)
    at packages/rocketchat_restivus/lib/route.coffee:59:33
    at packages/simple_json-routes.js:100:9
 => awaited here:
    at Promise.await (/snap/rocketchat-server/1536/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
    at Server.apply (packages/ddp-server/livedata_server.js:1752:22)
    at Server.call (packages/ddp-server/livedata_server.js:1721:17)
    at Object.post (app/api/server/v1/misc.ts:612:27)
    at app/api/server/api.js:463:96
    at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1257:12)
    at Object._internalRouteActionHandler [as action] (app/api/server/api.js:463:39)
    at Route._callEndpoint (packages/rocketchat_restivus/lib/route.coffee:150:32)
    at packages/rocketchat_restivus/lib/route.coffee:59:33
    at packages/simple_json-routes.js:100:9

```

---

<div class="post-metadata">

**Author:** ![joshburnett](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/joshburnett/32/4392_2.png) [@joshburnett](https://forums.rocket.chat/u/joshburnett)\
**Post date:** [January 21, 2023, 11:04am UTC](https://forums.rocket.chat/t/token-expired-while-resetting-password/15813/3 "2023-01-21T11:04:48Z")

</div>

Finally added the proper terms to my Google searches and found the relevant Github issue:

> <https://github.com/RocketChat/Rocket.Chat/issues/26296>
>
> \### Description:
> 
> Users can't reinitialize there password
> 
> \### Steps to repr…oduce:
> 
> 1. Logout (if your not);
> 2. Go to the login page;
> 3. Click on Forgotten password;
> 4. Enter my email and click on Reinitialize button;
> 5. Waiting couple of seconds to receive the email (less than 30 seconds);
> 6. Click on the link in the email to reinitialize my password;
> 7. Enter my new password on my RocketCHat website and click on Reinitialize;
> 8. RocketChat ask for the TOTP sent by email which I receive within few seconds;
> 9. I enter the code received by email;
> 10. RocketChat say : "Token expired".
> 
> \### Expected behavior:
> 
> Recognized token and continuing the flow of the reset password.
> 
> \### Actual behavior:
> 
> !\[image\](https://user-images.githubusercontent.com/98410832/179598897-0f6f8ade-1ac1-4c41-8ee7-e2e04596dbe2.png)
> 
> !\[image\](https://user-images.githubusercontent.com/98410832/179599039-7f045b02-ebbd-4766-9b10-f5724913973b.png)
> 
> \### Server Setup Information:
> 
> \- Version of Rocket.Chat Server: registry.rocket.chat/rocketchat/rocket.chat:4.8.1
> \- Operating System: Ubuntu 18.04
> \- Deployment Method: CapRover (Docker)
> \- Number of Running Instances: 1
> \- DB Replicaset Oplog: ?
> \- NodeJS Version: v14.18.3
> \- MongoDB Version: bitnami/mongodb:4.4
> 
> \### Client Setup Information
> 
> \- Desktop App or Browser Version: Firefox, maybe others...
> \- Operating System: Linux, maybe others...
> All clients with there own config are having the same problem.
> 
> \### Additional context
> 
> The timezone on the server and the container is UTC and correctly synced.
> TOTP by email is working correctly without the "password reset" context.
> The problem can be reproduced with a freshly created test user.
> 
> \### Relevant logs:
> 
> \`\`\`
> 2022-07-18T19:05:00.432060264Z {"level":50,"time":"2022-07-18T19:05:00.431Z","pid":1,"hostname":"c66002cdbf00","name":"System","msg":"Exception while invoking method resetPassword 'TOTP Required \[totp-required\]'"}
> 2022-07-18T19:05:49.176977717Z {"level":50,"time":"2022-07-18T19:05:49.176Z","pid":1,"hostname":"c66002cdbf00","name":"System","msg":"Exception while invoking method resetPassword 'Token expired \[403\]'"}
> \`\`\`