What is the forgot password flow if the user doesn't exist
-
If an email that is not registered to a user in FusionAuth is posted to a Forget Password flow from the UI, what does FusionAuth do?
-
There is no feedback to the user.
Whether the account exists with that email or not, the default message indicates a message will be sent.
If the user does not exist with that email, no email is sent.
The reason to avoid returning an error is to limit the ability to enumerate the users in the system, generally considered a bad thing(TM).
-
what about the password start event? will webhook receive a event for a user who does not exist in fusion auth?
This will be good feature especially if slow migration is used for migrating users
