fix: Prevent Timing Attacks by Removing await in Password Reset Flow (#21747)

* fix: correct password reset request handling logic

* fix: handle password reset request errors more gracefully

---------

Co-authored-by: Sebastian Brunow <90863358+Bratpfanne-4000@users.noreply.github.com>

apps/web/app/api/auth/forgot-password/route.ts

@@ -37,8 +37,7 @@ async function handler(req: NextRequest) {
       select: { name: true, email: true, locale: true },
     });
     // Don't leak info about whether the user exists
-    if (!user) return NextResponse.json({ message: "password_reset_email_sent" }, { status: 201 });
-    await passwordResetRequest(user);
+    if (user) passwordResetRequest(user).catch(console.error);
     return NextResponse.json({ message: "password_reset_email_sent" }, { status: 201 });
   } catch (reason) {
     console.error(reason);