fix: email enumeration via forgot password page (#4299)

Co-authored-by: Matthias Nannt <mail@matthiasnannt.com>
This commit is contained in:
Dhruwang Jariwala
2024-11-13 17:35:44 +05:30
committed by GitHub
parent 1f1563401d
commit 8c1f8bfb42
4 changed files with 6 additions and 7 deletions

View File

@@ -11,11 +11,10 @@ export const POST = async (request: Request) => {
},
});
if (!foundUser) {
return Response.json({ error: "No user with this email found" }, { status: 409 });
if (foundUser) {
await sendForgotPasswordEmail(foundUser, foundUser.locale);
}
await sendForgotPasswordEmail(foundUser, foundUser.locale);
return Response.json({});
} catch (e) {
return Response.json(