Accounts auth
Password reset
Forgot-password flow emails a reset token and allows setting a new password.
Implemented Verified from source User-facing
In one sentence
Users request a reset email; a time-limited token lets them set a new password without revealing account existence.
Current behavior
Forgot form always shows a generic success message. If the email exists, a token is stored and emailed. Reset page validates token, then updates password_hash and clears token fields.
Known limitations
- No rate limiting observed on forgot-password requests.
- Depends on working SMTP configuration.