Options for password reset requests

In the scenario where a client requests a password reset but does not have an account, it's generally recommended to avoid revealing whether or not an account exists for security reasons. Here's how you can handle this situation:

Option 1 (displaying an on-screen message that they don't have an account) is indeed not recommended, as it could potentially expose information that malicious actors could exploit.

Option 2 is closer to best practices, but with some modifications:

Instead of sending an email specifically stating they don't have an account, the recommended approach is to handle the request as if the account exists, even when it doesn't. This is known as preventing user existence errors.

When a password reset is requested for a non-existent account, Amazon Cognito can be configured to return a simulated response. It will act as if it sent a recovery code to the email address or phone number provided, without actually sending anything. This approach doesn't disclose whether an account exists or not.

The response to the user, both on-screen and via email (if you choose to send one), should be generic. For example:

"If an account exists for the email address you provided, you will receive password reset instructions shortly. If you don't receive an email, please check your spam folder or try again."

This approach:

1. Maintains security by not revealing account existence.
2. Provides a consistent user experience whether the account exists or not.
3. Doesn't discourage potential new users from signing up if they mistakenly tried to reset a non-existent password.

Remember, the goal is to balance security with user experience, ensuring that your system doesn't inadvertently become a tool for enumerating valid user accounts.
Sources
Passwords, account recovery, and password policies - Amazon Cognito
Managing user existence error responses - Amazon Cognito