Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why should a password reset endpoint return an identical response regardless of whether the submitted email actually corresponds to a real account?
💻 Code Challenge | +75 XP
Implement a password reset flow: a request endpoint returning an identical response regardless of account existence, a cryptographically random hashed token with a 1-hour expiration, and a completion endpoint that invalidates all existing sessions upon a successful reset.
A security audit found that a password reset endpoint returned a distinct "email not found" error for non-existent accounts, allowing account enumeration, and reset tokens were stored in plaintext with no expiration enforced. Reorder the steps to fix all three issues.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Returning a different response depending on whether a submitted email corresponds to an existing account
// Wrong: leaks account existence via a different response
if (!userExists) return res.status(404).json({ error: "Email not found" });
// Correct: identical response either way
res.json({ message: "If that email exists, a reset link has been sent" });The Solution //
A distinguishable response (like a specific "email not found" error) lets an attacker systematically enumerate which email addresses correspond to real accounts on the platform by testing many emails and observing the different responses — the reset request endpoint should always return an identical response regardless of whether the account actually exists.
The Error //
Storing password reset tokens in plaintext, or with no enforced expiration
// Wrong: plaintext, no expiration enforced
await db.resetTokens.insert({ token: resetToken, userId });
// Correct: hashed, with a strictly enforced short expiration
await db.resetTokens.insert({ token: hashToken(resetToken), userId, expiresAt: Date.now() + 3600000 });The Solution //
A plaintext reset token is exactly as dangerous as a plaintext password if the database is ever compromised, letting an attacker immediately reset any account whose token hasn't expired. A token with no enforced expiration remains a valid attack surface indefinitely, long after any legitimate reset attempt would have completed.