codesnips

account-enumeration

ruby 
user = User.find_by(email: params[:email].to_s.downcase.strip)

if user
  raw_token = SecureRandom.urlsafe_base64(32)
  user.password_resets.create!(token_digest: Digest::SHA256.hexdigest(raw_token), expires_at: 30.minutes.from_now)
  PasswordResetMailer.with(user: user, token: raw_token).deliver_later

Password reset flow that avoids user enumeration and token leaks

password-reset account-enumeration authentication
by Kai Nakamura 1 tab