Password reset flow
Constant-shape response, single-use token, session revocation.
Request + confirm endpoints. Known and unknown addresses receive the same accepted response shape, email dispatch happens after the response, and a configured response floor reduces account-existence timing signal. Token and audit database work still differs for a known user, so this is not a whole-request constant-time guarantee. Prior unconsumed tokens are invalidated on successful reset, and all sessions are revoked.
Mockup of the dashboard view for this feature. Live-reloading and themed to match your dashboard.
Ships with
- Constant-shape response: accepted=true for known + unknown emails
- Background email dispatch plus a uniform response floor reduce timing differences without claiming constant time
- Atomic session revoke on successful confirm
- Prior tokens invalidated so a held earlier token cannot second-reset
Related