Password reset flow
Constant-shape response, single-use token, session revocation.
Request + confirm endpoints. Known and unknown addresses receive the same accepted response shape, email dispatch happens after the response, and a configured response floor reduces account-existence timing signal. Token and audit database work still differs for a known user, so this is not a whole-request constant-time guarantee. Prior unconsumed tokens are invalidated on successful reset, and all sessions are revoked.
The related dashboard view, captured with sample project data. Open the live demo to try it.
Ships with
- Constant-shape response: accepted=true for known + unknown emails
- Background email dispatch plus a uniform response floor reduce timing differences without claiming constant time
- Atomic session revoke on successful confirm
- Prior tokens invalidated so a held earlier token cannot second-reset
Related