Generator-jhipster: Password reset allows to check which mails exist

[atomfrede]

Overview of the issue

When doing a password reset a bad request is returned in case the mail does not exist in the system. With this it is possible to harvest existing mails. I think it would be better to always return "OK" to the api/frontend and log the invalid attempt on the server side.

Motivation for or Use Case

Automatically check which mails exist.

Reproduce the error

Create a default jhipster app and request a password reset for e.g. [email protected]. Both the rest api and the frontend show that that mail does not exist.

Related issues

None I am aware of.

Suggest a Fix

Always return "ok" such that the client/consumer needs to check the mail and there is no hint that mail didn't exist (or other way round there is no hint which mail was real).

JHipster Version(s)

Tried with latest master.

[atomfrede]

I checked keycloak and it also does pretend the password reset request was successful, so I will do a PR for all our frontends and adapt the server part if everyone is okay with that.