Which option is the best acceptance criterion for a password reset feature?

Question

BlackTom AI · Accepted Answer

Acceptance criteria must be specific, measurable, testable, secure, and usable. For a password reset feature that means specifying exact timing for delivery and expiry, expected user behavior, and security characteristics.

Relevant knowledge points:
- Measurable criteria: delivery time and expiry must be quantifiable (seconds/minutes).
- Usability vs. security trade-off: short expiry increases security but may frustrate users; long expiry increases risk of token compromise.
- Testability: acceptance must allow reproducible tests (send request, measure delivery, validate token before/after expiry).

Step-by-step reasoning:
1. Delivery requirement: “emailed within 30 seconds” is a clear, measurable SLA. To test: request a reset and record time t0; observe email arrival time t1; compute delta = t1 − t0. Acceptance: delta ≤ 30 s. This ensures good user experience and quick recovery.
2. Expiry requirement: “expires after 60 minutes” gives a concrete security window. Convert: 60 minutes = 60 × 60 = 3600 seconds. Token should be valid for any t such that 0 < t ≤ 3600 s after issuance and invalid for t > 3600 s. This is long enough for most users to complete reset but short enough to limit token abuse.
3. Security/usability balance: 60 minutes reduces risk compared with multi-hour or day-long tokens, while 30 s delivery avoids user confusion waiting for email.

Why this answer is correct:
- It is specific and testable (exact times).
- It balances usability (fast delivery, reasonable window to act) with security (limited validity).
- It permits clear automated and manual test cases: immediate usability (link works), expiry behavior (link invalid after 60 minutes), and performance (deliver within 30 s).

Why other common options are inferior:
- Very long expiry (e.g., 24 hours) increases risk of token compromise.
- Very short expiry (e.g., 5 minutes) may frustrate users unable to access email promptly.
- Non-email methods (security questions) are often less secure and less testable.
- Not specifying delivery time is non-testable.

Conclusion: The correct acceptance criterion is: “A reset link is emailed within 30 seconds and expires after 60 minutes.” This matches the provided answer.

Which option is the best acceptance criterion for a password reset feature?单项选择题

类似问题

Consider this user story: “As a commuter, I want to top‑up my travel card online so that I can avoid station queues.” What crucial component is still missing?

Acceptance criteria are an important part of a user story because:

What is NOT true about acceptance criteria?

Acceptance criteria are an important part of a user story because:

Acceptance criteria are an important part of a user story because:

Acceptance criteria are an important part of a user story because:

Consider this user story: “As a commuter, I want to top‑up my travel card online so that I can avoid station queues.” What crucial component is still missing?

What was the world's first widely adopted biodiversity policy?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单