5 Ways to Debug Password Reset Email Retries Causing Duplicate Links

To prevent duplicate password reset links from being generated due to email retry failures, there are several key strategies to follow. First and foremost, ensure that each reset request produces a single active link. This can be achieved by generating a token before enqueuing the delivery job and storing only its hash, which is then bound to the user and a request window. The delivery job should receive a stable ID rather than creating a new password-reset event.

When a retry occurs, it should read the existing intent rather than minting a new one. This can be enforced by keeping track of one active intent per user and request window in the database, rather than relying solely on process memory. In case of race conditions between web requests, the winning record holds the stable delivery ID, while the losing transaction reloads and uses it.

A 32-byte random token can be stored as a hash, but the raw value must be securely handed to the first delivery path because the hash cannot reconstruct the URL.

The reason password reset email retries often create duplicate links lies in the retry worker's behavior. When a request fails, the worker may create security state again instead of replaying the delivery state. This is problematic for bounced or blocked recipients, as exponential backoff does not improve the situation. Before sending any email, including retries, immediately check suppression to avoid trapping a newly suppressed address in an old queue item.

To implement this, set up required environment variables such as EMAIL_API_BASE_URL, INFRAI_API_KEY, and RESET_EMAIL. Create a TypeScript function that checks suppression using a GET request with the appropriate headers. If the response status is 429 (too many requests) and the attempt count is less than 4, wait for a specified amount of time before retrying. If the response is not successful, throw an error detailing the failure. Log the JSON string of the suppression check result.

It's essential to treat the suppression check as a delivery decision rather than evidence of an existing account. Password-reset responses should behave the same for known and unknown addresses internally. Record a narrow reason such as suppressed, deferred, or provider_rejected instead of logging the email address, reset token, or full reset URL.

Synchronize this result into application-owned suppression handling for chronic bad addresses to provide a stable answer in case the next delivery attempt uses a different provider.

Finally, use exponential backoff for transient delivery failures and honor Retry-After on HTTP 429 responses. When an idempotency mechanism exists, place the stable reset-intent ID in it. Set a finite attempt budget and ensure the job expires no later than the link itself. Keep the reset intent and delivery job as separate state machines to make the trade-off between using the same link versus generating fresh valid links on every retry clear.

While reusing a link may result in an already used or expired URL in subsequent messages, creating fresh valid links on every transport retry introduces a larger and harder-to-explain security surface.