The "New API token" page defaults to "no expiration"

[fasterthanlime]

Current Behavior

The "New API token" page defaults to "no expiration"

Expected Behavior

I think it should default to, like, "90 days". Or even "365 days" if you want to be conservative.

Defaults matter here. If I'm going to be irresponsible with a never-expiring token, make me do two additional clicks.

Steps To Reproduce

1. Go to https://crates.io/settings/tokens/new
2. Notice it defaults to no expiration

Environment

• Browser: Microsoft Edge, for the street cred
• OS: Windows 11, to have sound

Anything else?

Thanks for your work on this! The new form is definitely a step in the right direction.

[Turbo87]

We've chosen this default for now since it matches the previous behavior. Once people are a bit more familiar we will most likely switch it over to one of the presets instead.

[zahash]

can i work on this issue? i can change it to 30 days.

[Turbo87]

we have not decided yet at what point we want to change the default value. until then it's probably not worth looking into :)

[Turbo87]

we talked a bit about this issue in our team meeting last friday. the conclusion was that we would like to have an implementation of token expiry warning emails first before we switch the default expiry time. the reasoning behind this is the situation where a Rust newcomer creates a default token on crates.io to put it into cargo and then 30 days later is surprised that nothing works anymore. we feel like this situation can be mitigated to some degree by having such expiry emails.