Preventing User Enumeration in Craft Password Reset Form

This is a fol­low-up video on the orig­i­nal course and will also be the source for an arti­cle on the same topic.

In the pre­vi­ous video on cre­at­ing a pass­word reset form, we didn’t tak­cle one impor­tant secu­ri­ty issue when it comes to reset­ting pass­word: enumeration. 

User enu­mer­a­tion is the abil­i­ty to estab­lish the exi­tence of a user account by some­thing like an email address. This can be deter­mined by read­ing the response mes­sage of a pass­word reset form or by tim­ing the amount of time it takes to respond. 

Craft CMS has user enu­mer­a­tion pre­vent­ing built in, how­ev­er it is not enabled by default.