Developer forum

The link in the mail it self does not have a referrer policy, but the website where the link points to have (you DW site). You can control the response headers under settings->web&http (See security headers): https://doc.dynamicweb.com/documentation-9/platform/advanced-settings/web-and-http#3518

What the correct settings are, I do not know - each "Specialist" have different opinions, so you can talk to them how they think it should be.

The recovery link has an expiration already - you can define your own expiration on the login page (Read the lasst grey box in this link):

https://doc.dynamicweb.com/documentation-9/users/user-management/extranet/login-mode#2519

Once the recovery link has been used, the token is reset and cannot be used again. Recovery token has a minimum validity of 1 hour, so you cannot change it to 10 minutes.

This is the default setup for Swift:

Hi Nicolai,

Thank you for the prompt response.

Is the "Link active for" feature available also for Rapido?  This is for a Rapido customer.

For the security header regarding the referrer policy, would you expect to have issues if we set it to "no-referer"?

I cannot remember how Rapido does password reset, but if it uses the "send link to reset page" you can set the expiration.

Currently browsers have strict-origin-when-cross-origin as their defaults, so the advice you have been given related to referer policy might be kind of out of date for 99% of users.

Setting referer policy to no-referer (which is more strict than default browser behavior) will probably break something in the website - could affect add to cart, login redirects and other things that relies on a internal website referer value. A less risky setting would be strict-origin-when-cross-origin or same-origin which will keep referer inside the same hostname, but not send the referer to other hostnames. But as said, that is default browser behavior already so would practically have little or no effect.

BR Nicolai

You are absolutely right! Found the same settings in Rapido under Customer center - it is set by default to 1 hour as well.

Regarding your suggestion for the referrer-policy, I will inform the customer, try and see.

BR Barry