# default\_token\_generator.check\_token - always True **URL:** \ **Category:** Using Django\ **Created:** [December 11, 2020, 3:45am UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649 "2020-12-11T03:45:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ckimberley](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/ckimberley/32/488_2.png) [@ckimberley](https://forum.djangoproject.com/u/ckimberley)\ **Post date:** [December 11, 2020, 3:45am UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/1 "2020-12-11T03:45:18Z")
Just as the title says no matter what I’ve tried this function always returns true which is problematic. I have tried moving the auth\_user.date\_joined value to last year in hopes that check\_token would see this as an expired token. So far no luck. if user is not None and default\_token\_generator.check\_token(user, token): user.is\_active = True user.save() ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [December 11, 2020, 4:53am UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/2 "2020-12-11T04:53:51Z")
The date\_joined field isn’t used anywhere in the token creation process. The call uses `now()` for creating it. If you want to test it, you can change the user or timestamp in the token to determine whether or not it catches the alteration, and you can change the PASSWORD\_RESET\_TIMEOUT setting to a much shorter window. ---
**Author:** ![ckimberley](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/ckimberley/32/488_2.png) [@ckimberley](https://forum.djangoproject.com/u/ckimberley)\ **Post date:** [December 11, 2020, 5:30am UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/3 "2020-12-11T05:30:23Z")
Hi Ken, Thanks for your response. I may not have been clear, but I’m looking at the function check\_token and I was hoping that it checks against the date the user was created in order to determine if a token might be expired. I’ve read that the function check\_token does check for expiry but wasn’t able to see this occur. In any event I’ve found a workaround rather than using check\_token, but if it can indeed check for expired tokens I’d be happy to use it. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [December 11, 2020, 5:34am UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/4 "2020-12-11T05:34:16Z")
It does check for expired tokens - but the check is based upon the time the token is created, not when the user is created. And, the window of time for which the token is valid is based upon the setting [PASSWORD\_RESET\_TIMEOUT](https://docs.djangoproject.com/en/3.1/ref/settings/#password-reset-timeout). ---
**Author:** ![ckimberley](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/ckimberley/32/488_2.png) [@ckimberley](https://forum.djangoproject.com/u/ckimberley)\ **Post date:** [December 11, 2020, 4:36pm UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/5 "2020-12-11T16:36:53Z")
Which database table/column is used to check the time? Perhaps this is what I’m missing. Thanks. ---
**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\ **Post date:** [December 11, 2020, 4:39pm UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/6 "2020-12-11T16:39:23Z")
It’s not. There’s no table involved in the check. It calculates the current time - the time the token was created (which is part of the token) and checks to see if it’s less than PASSWORD\_RESET\_TIMEOUT. What is it exactly that you’re trying to do here? Is it possible that you’re looking for the wrong “thing”? ---
**Author:** ![ckimberley](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/ckimberley/32/488_2.png) [@ckimberley](https://forum.djangoproject.com/u/ckimberley)\ **Post date:** [December 11, 2020, 5:56pm UTC](https://forum.djangoproject.com/t/default-token-generator-check-token-always-true/5649/7 "2020-12-11T17:56:10Z")
I think I was misunderstanding the way the token works, however it now makes sense to me. I set PASSWORD\_RESET\_TIMEOUT=30 in settings.py and now I am seeing that check\_token returns false which is great. Essentially what I’m building is a basic register/activate process in a website where a user receives an email with a link to click and activate their account. I think the setting you provided is what I was looking for and the other piece I needed to understand was that the creation time was built into the token itself. Thanks! and hopefully I can get the rest of the functionality working with this information.