Password reset flows that do not leak accounts or tokens

Goal

Let a user who lost their password regain access without giving an attacker a way to take over the account or to learn which addresses are registered.

Prerequisites

Passwords stored as salted, slow hashes; a way to send email (or another side channel) that the application controls; a rate limiter that can count per account and per source address.

Steps

1. Accept the request form for any input. The OWASP cheat sheet (cited) asks for a consistent message for existent and non-existent accounts and a consistent response time; do the same work for both branches instead of returning early.
2. Rate-limit requests per account and per source, so that an attacker cannot flood a victim's inbox or brute-force tokens.
3. Generate the token with a cryptographically secure random generator, long enough to defeat guessing, linked to one user, with a short expiry; store only a hash of it, as for a password. Signed tokens such as JWTs are possible but bring their own failure modes.
4. Build the reset URL from a configured origin, never from the request's Host header, so a poisoned header cannot redirect the link to an attacker's domain. Use HTTPS.
5. Serve the reset page with Referrer-Policy: no-referrer so the token in the URL is not leaked to third-party resources, and rate-limit the token endpoint too.
6. Change nothing about the account until a valid token is presented: no lockout, no flag, no password change.
7. On a valid token: require the new password twice, apply the usual password policy, store it, invalidate the token, and either invalidate other sessions or offer to. Do not log the user in from the reset page; send them to the normal login.
8. Send a notification that the password was changed (without the password). Keep a path for users who no longer control the side channel, such as verified support contact.

Expected result

A reset request for an unknown address and for a known one are indistinguishable to the requester; a captured link expires quickly and works once; a Host header injection or referrer leak yields nothing usable.

Limits and test basis

Follows the cited cheat sheet; no measurement claimed. SMS PINs (6 to 12 digits, sent through a side channel) trade token length for a limited session that may only reset the password. Security questions alone are not a recovery method. Accounts with MFA need the MFA recovery path, not this one.