Validate if email address exists in Lock’s forgot password screen

[BharagvBajani]

We using Lock with native to login/signUp in email. But when click on Don’t remember password and send reset link no email validation is the user is Signed up or not. for any email getting a success response.

Is there any way to prevent unregistered users?

[john.gateley]

Hi @BharagvBajani

This is by design. If you enter a valid email, the password reset link is sent. If you enter an invalid email, nothing is sent.

This avoids information leakage (which emails are valid).

John