Challenge 1 / 2

Submit the forgot-password form with an email that has no account, and the controller doesn't tell you. It sends you to the very same "check your email" page - and since that page shows how long the link is good for, it's handed a fake token so the expiry reads exactly like the real thing.

Why go to that length?

Generating a fake token keeps the response time identical, which is the only thing an attacker can actually measure.

The fake token reserves a row in reset_password_request, so the throttle limit applies to unknown addresses too.

If the two cases looked any different at all, the reset form would become a handy tool for discovering which addresses have accounts.

It gives the bundle's garbage collection something to clean up, keeping the table's behavior consistent.

Rewatch the video