Checksum and Shifting Expiration Windows

Question

Where/when does CiviCRM calculate the expiration date of a checksum? Is the expiration date encoded in the checksum upon generation, or is the date of checksum creation encoded and then the creation date is compared to the default expiration setting?

This is relevant to the following scenarios:

1)a checksum is created with an expiration default of 30 days. Contacts are sent a checksum.
2a)The expiration default is altered from 30 days to 14. Will the previously created checksum still work between days 15-30?
2b)The expiration default is altered from 30 days to 60. Will the previously created checksum work between days 31-60?

Answer 1

The checksum string is created when the token is processed, so everytime the checksum string is created it has the expiry date based on 'Checksum Lifespan' set in your systems under CiviCRM >> Administer >> System Settings >> MISC.

When validating the checksum is decoded to get the exipry date and checked against now().

Regarding your question

• 1 -> Yes
• 2 -> Yes(since the checksum has expiry date)
• 3 - No