Expiring Confirmation Links 

Basics 

Every link femanager sends by email carries a signed expiration date and stops working once that date has passed. This applies to all four workflows:

• the double-opt-in link the newly registered user receives,
• the confirmation and refusal links the administrator receives for a registration,
• the confirmation and refusal links the administrator receives for a profile change,
• the invitation link.

The default lifetime is one day. Setting the lifetime to 0 disables the expiration, which restores the behaviour of femanager 13 and earlier, where a link stayed valid forever.

The expiration date is part of the signed value, so it cannot be manipulated. No database field is involved and nothing has to be cleaned up.

Besides the expiration date the signature is bound to the uid of the user and to the workflow step the link belongs to, so a link works neither for another user nor for another step. The uid and not the username is signed, because TYPO3 does not enforce unique usernames. Renaming a user therefore keeps the links already sent to them working until they expire.

Note: opening a form with a valid link issues a fresh link for the form itself, so filling in the invitation form or the confirmation dialog cannot fail because the original link expired in the meantime.

TypoScript Settings 

The lifetime is configured per workflow, in seconds:

plugin.tx_femanager {
	settings {
		new {
			# Seconds a registration confirmation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.new.confirmationLinkLifetime}
		}
		edit {
			# Seconds a profile change confirmation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.edit.confirmationLinkLifetime}
		}
		invitation {
			# Seconds an invitation link stays valid. 0 lets the links never expire.
			confirmationLinkLifetime = {$plugin.tx_femanager.settings.invitation.confirmationLinkLifetime}
		}
	}
}

What happens when a link expired 

Registration

The visitor gets the message confirmationLinkExpired and is sent to the resend dialog, where a new confirmation mail can be requested with the email address. See Resend User Confirmation Request. An administrator can trigger a new mail from the backend module, and the command femanager:sendUserConfirmationReminder does the same for all users whose registration is still unconfirmed.

Profile change

The administrator gets the message confirmationLinkExpiredUpdate. The pending change is kept in tx_femanager_changerequest, so nothing is lost - the user can submit the change again, which sends a new request mail.

Invitation

The invited user gets the message confirmationLinkExpiredInvitation. There is no self-service here, an administrator has to invite the user again.

The three messages are regular labels in EXT:femanager/Resources/Private/Language/locallang.xlf and can be overridden like any other label.

Telling the recipient how long a link works 

The mail templates that contain a workflow link receive the variable {linkValidUntil}, a DateTimeImmutable holding the moment the links stop working. It is empty when the links never expire. Use it in your own templates like this:

<f:if condition="{linkValidUntil}">
    This link is valid until <f:format.date format="d.m.Y H:i">{linkValidUntil}</f:format.date>.
</f:if>

Rate limiting 

Requesting a new confirmation mail is subject to the same rate limiter as the registration itself, see Rate Limiter.