# Re-sending activation links causes issues

**URL:** <https://meta.discourse.org/t/re-sending-activation-links-causes-issues/32250>\
**Category:** Bug\
**Created:** [18.Август.2015 14:08:08 UTC](https://meta.discourse.org/t/re-sending-activation-links-causes-issues/32250 "2015-08-18T14:08:08Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)\
**Post date:** [21.Август.2015 19:18:24 UTC](https://meta.discourse.org/t/re-sending-activation-links-causes-issues/32250/4 "2015-08-21T19:18:24Z")

</div>

Hooray – I’ve been able to reproduce _exactly_ what was explained to me on my production instance. The steps and symptoms differ a bit.

I have `email token valid hours` and `purge unactivated users grace period days` set to their default values. Then, I did the following steps:

1. Sign in with SSO to a non-existing account. Since our SSO provider does not validate E-Mails, Discourse sends out an activation mail: ![](https://global.discourse-cdn.com/meta/original/3X/4/5/45592d56c2e1b729beb708e88422dd7b75ccebfc.png)
2. Wait between 24 hours and 7 days, so the link expires but the account survives.
3. Click the link, click the button to activate the account. Unsurprisingly, this tells me the link is invalid: ![](https://global.discourse-cdn.com/meta/original/3X/6/b/6b358042dca3a097b8392d32b8332315db6924b9.png)
4. Re-try to login. Once again, Discourse tells me it sent out an activation mail. I did _not_ get the screen telling me that I can re-send the mail – it looked just as in step 1! Discourse sends out a new activation mail: ![](https://global.discourse-cdn.com/meta/original/3X/f/d/fdd134952c00140b295357271198954aad7e1561.png)
5. Try to activate the account, which once again fails.

This failure is no surprise: _Discourse sent out the old, expired token again!_ Look at my screenshots above, which include the date and time (both were captured just now, so no date means 21.08.2015).

While I’m not entirely sure why the behavior differs, the core difference seems to be SSO (my test install did not use SSO!). Both versions seem like a bug to me, with this one being more severe.

---

_[View the full topic](https://meta.discourse.org/t/re-sending-activation-links-causes-issues/32250)._