What are the most common security pitfalls in a password reset flow?

Password reset is a high-value target because it is effectively an authentication bypass — get it wrong and an attacker can take over any account without knowing the password.

Common pitfalls:

1. Weak token entropy: reset tokens generated with predictable values (timestamp, sequential ID, Math.random()) can be brute-forced or guessed. Tokens must be cryptographically random and at least 128 bits (e.g. 32 hex chars from crypto.randomBytes).

2. Long token expiry: a reset token valid for 24 hours or more is a large window for an attacker who intercepts email. Tokens should expire within 15–60 minutes and be single-use (invalidated immediately after use).

3. User enumeration: returning different messages for 'email found' vs. 'email not found' lets an attacker enumerate valid accounts. Always return the same response: 'If that email is registered, you'll receive a reset link.'

4. Token in URL logged to server logs: the reset link contains the token in the URL — if the app logs request URLs (access logs), the token appears in plaintext. Mitigations: use POST-based submission or ensure access logs are scrubbed of query parameters.

5. Old tokens not invalidated: when a password is successfully reset, all previous reset tokens and all existing sessions must be invalidated. A user who resets their password because they suspect a compromise shouldn't have their old session survive.

6. No rate limiting: allowing unlimited reset attempts enables email flooding (DoS/spam) and potentially token brute-force if tokens are short.