From e781a78eea305e474048841d5a2548f0500f48a8 Mon Sep 17 00:00:00 2001
From: Sebastian Brunow <90863358+Sebastian-Brunow@users.noreply.github.com>
Date: Tue, 10 Jun 2025 00:44:24 +0200
Subject: [PATCH] fix: Prevent Timing Attacks by Removing await in Password
 Reset Flow (#21747)

* fix: correct password reset request handling logic

* fix: handle password reset request errors more gracefully

---------

Co-authored-by: Sebastian Brunow <90863358+Bratpfanne-4000@users.noreply.github.com>
---
 apps/web/app/api/auth/forgot-password/route.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/apps/web/app/api/auth/forgot-password/route.ts b/apps/web/app/api/auth/forgot-password/route.ts
index 9e598196f6..064dfce857 100644
--- a/apps/web/app/api/auth/forgot-password/route.ts
+++ b/apps/web/app/api/auth/forgot-password/route.ts
@@ -37,8 +37,7 @@ async function handler(req: NextRequest) {
       select: { name: true, email: true, locale: true },
     });
     // Don't leak info about whether the user exists
-    if (!user) return NextResponse.json({ message: "password_reset_email_sent" }, { status: 201 });
-    await passwordResetRequest(user);
+    if (user) passwordResetRequest(user).catch(console.error);
     return NextResponse.json({ message: "password_reset_email_sent" }, { status: 201 });
   } catch (reason) {
     console.error(reason);