Skip to content

Commit

Permalink
Deliver password reset email asynchronously
Browse files Browse the repository at this point in the history
Fixes a potential timing attack where someone could find out
whether an email address is in our database or not.
  • Loading branch information
ukutaht committed Jan 20, 2022
1 parent 2037605 commit 3e46f1b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/plausible_web/controllers/auth_controller.ex
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ defmodule PlausibleWeb.AuthController do
url = PlausibleWeb.Endpoint.url() <> "/password/reset?token=#{token}"
Logger.debug("PASSWORD RESET LINK: " <> url)
email_template = PlausibleWeb.Email.password_reset_email(email, url)
Plausible.Mailer.deliver_now!(email_template)
Plausible.Mailer.deliver_later(email_template)

render(conn, "password_reset_request_success.html",
email: email,
Expand Down

0 comments on commit 3e46f1b

Please sign in to comment.