showing password-reset email status success even when I don't have CARE user account.

[jaimin1618]

Describe the bug
Even when I don't have account on CARE system, it is showing me "password reset link sent successfully" when I do forgot password on login page and then random username as input.

To Reproduce
Steps to reproduce the behavior:

1. Go to "Authorized Login" page (login page)
2. Click on "forgot password"
3. Write invalid/random Username to send email on associated email-address with that user.
4. It shows success status "Password reset email sent"

Expected behavior
Expected status should be "Invalid user" OR "User not available in database"

Screenshots

Desktop (please complete the following information):

• OS: Windows 11
• Browser Brave
• Version latest

Additional context
It looks like this is a frontend issue. I don't have any registered account on the CARE system, so it is not possible that my user is already available in the database. hence it is not possible to send me a password reset link and it did not. So, it looks like it received "success" status on the frontend and showed me "password reset email sent".

[Marmik2003]

@JAIMIN-CHOKHAWALA I think the current way is a good way from security perspective... This way, we can be ensure that no one can apply the bruteforce techniques to find existing users and send spams or apply other attacks, yes... but I agree that the message should be changed to "Password reset email will be sent shortly if account exists"

[skks1212]

Yep, we have to make sure that all user information is intact.
The text on the forgot password page has been changed in PR care_fe #2665

[sainak]

closing this issue as it's being tracked in coronasafe/care_fe#2664

[jaimin1618]

@sainak, Yeah sure it is better to close it but I also with @Marmik2003 about changing status message.

[sainak]

@JAIMIN-CHOKHAWALA coronasafe/care_fe#2665 will update the status message