Is it a bad security practice to provide an endpoint which verifies a reset password token?

For the sake of good UX, I made an endpoint that verifies a given token and throws an error if its invalid. This is done so that if the user opens an expired reset password link, they will immediately know if it's expired or not rather than filling all the information and finding out it's expired when they hit submit. It's rate limited pretty harshly (5 requests per 60 seconds) but I wonder if it's bad security practice to have …

bad cybersecurity endpoint password security token