Comment 1 for bug 781438

Fran├žois Marier (fmarier) wrote :

The Mozilla secure coding guidelines recommend expiring them after 8 hours:

  https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Email_Change_and_Verification_Functions