Delete password reset token when the link is clicked

[CodingMarco]

I would say a password reset token should be deleted as soon as the user clicks on the link in the email, not when the password is actually set. This would prevent tokens from building up in the database.

[Bennik2000]

When I implemented this function I explicitly decided to delete the token after the password was set.

Deleting the token as soon as the user clicks on the link means that the site can be accessed only once. Meaning that a refresh of the page is not possible.

One possibility to prevent having not needed tokens in the database would be to add an expiration date to tokens. This means that the link will be valid for e.g. 24 hours maximum.