Password reset email pattern in Flask - Performance & Optimization

Performance: Password reset email pattern

MEDIUM IMPACT

This pattern affects page load speed indirectly by impacting server response time and user interaction responsiveness during password reset requests.

Sending password reset emails after user request

Flask

from flask import Flask, request
from flask_mail import Mail, Message
from threading import Thread
app = Flask(__name__)
mail = Mail(app)

def send_async_email(app, msg):
    with app.app_context():
        mail.send(msg)

@app.route('/reset-password', methods=['POST'])
def reset_password():
    email = request.form['email']
    token = 'secure-token'
    msg = Message('Reset Your Password', recipients=[email])
    msg.body = f'Click to reset: https://example.com/reset/{token}'
    Thread(target=send_async_email, args=(app, msg)).start()  # Send email asynchronously
    return 'Email sent', 200

Sending email asynchronously frees server to respond immediately, improving interaction responsiveness and user experience.

📈 Performance GainNon-blocking response reduces INP by 500-2000ms, improving perceived speed.

Sending password reset emails after user request

Flask

from flask import Flask, request
from flask_mail import Mail, Message
app = Flask(__name__)
mail = Mail(app)

@app.route('/reset-password', methods=['POST'])
def reset_password():
    email = request.form['email']
    # Generate token here
    token = 'secure-token'
    msg = Message('Reset Your Password', recipients=[email])
    msg.body = f'Click to reset: https://example.com/reset/{token}'
    mail.send(msg)  # Sending email synchronously
    return 'Email sent', 200

Sending email synchronously blocks the server response, causing slow user feedback and poor interaction responsiveness.

📉 Performance CostBlocks server response for 500-2000ms depending on email server, increasing INP and user wait time.

Performance Comparison

Pattern	Server Blocking	User Wait Time	Interaction Responsiveness	Verdict
Synchronous email sending	Blocks server thread	High (500-2000ms)	Poor (high INP)	[X] Bad
Asynchronous email sending	Non-blocking	Low (<100ms)	Good (low INP)	[OK] Good

Rendering Pipeline

Password reset email sending affects server response time, which impacts how quickly the browser can update the UI after user interaction.

→Server Processing

→Network Response

→User Interaction

⚠️ BottleneckServer Processing when sending email synchronously

Core Web Vital Affected

INP

This pattern affects page load speed indirectly by impacting server response time and user interaction responsiveness during password reset requests.

Optimization Tips

1Never send emails synchronously during user requests; use asynchronous methods.

2Offload heavy tasks like email sending to background threads or jobs.

3Monitor server response times to keep interaction responsiveness high.

Performance Quiz - 3 Questions

What is the main performance problem with sending password reset emails synchronously in Flask?

A It blocks the server response, increasing user wait time.

B It increases the bundle size sent to the browser.

C It causes layout shifts in the browser.

D It reduces network bandwidth.

DevTools: Network and Performance panels

How to check: Use Network panel to check server response time for password reset request. Use Performance panel to record interaction and see delay before next paint.

What to look for: Look for long server response times and delayed UI updates indicating blocking operations.

Practice

1. What is the main purpose of using a token in a Flask password reset email pattern?

easy

A. To securely verify the user's identity before allowing password reset

B. To store the user's new password temporarily

C. To send the user's password in plain text via email

D. To log the user out of all sessions automatically

Solution

1. Step 1: Understand the role of tokens in password reset

   Tokens are unique codes sent to users to confirm their identity securely during password reset.

2. Step 2: Identify the purpose of the token

   The token ensures only the rightful user can reset the password by verifying their identity.

3. Final Answer:

   To securely verify the user's identity before allowing password reset -> Option A

4. Quick Check:

   Token = Secure identity verification [OK]

Hint: Tokens verify identity safely before password changes [OK]

Common Mistakes:

• Thinking tokens store passwords
• Assuming tokens send passwords in email
• Believing tokens log users out

2. Which of the following is the correct way to create a timed token using Flask's itsdangerous library?

easy

A. token = URLSafeTimedSerializer.dumps(secret_key, email)

B. token = URLSafeTimedSerializer(secret_key).loads(email)

C. serializer = URLSafeTimedSerializer(); token = serializer.dumps(secret_key, email)

D. serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email)

Solution

1. Step 1: Recall the correct usage of URLSafeTimedSerializer

   It requires initializing with a secret key, then calling dumps() with the data to encode.

2. Step 2: Match the syntax to the correct option

   serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email) correctly creates the serializer and calls dumps(email) to create the token.

3. Final Answer:

   serializer = URLSafeTimedSerializer(secret_key); token = serializer.dumps(email) -> Option D

4. Quick Check:

   Serializer + dumps(data) = token [OK]

Hint: Initialize serializer with key, then dumps(data) for token [OK]

Common Mistakes:

• Calling dumps as a static method
• Passing secret key to dumps instead of constructor
• Using loads instead of dumps to create token

3. Given this Flask code snippet, what will be printed if the token is valid and not expired?

from itsdangerous import URLSafeTimedSerializer
serializer = URLSafeTimedSerializer('secret')
token = serializer.dumps('[e-mail]')

try:
    email = serializer.loads(token, max_age=3600)
    print(email)
except Exception:
    print('Invalid or expired token')

medium

A. None

B. [e-mail]

C. secret

D. Invalid or expired token

Solution

1. Step 1: Understand what serializer.dumps and loads do

   dumps creates a token from the email string; loads decodes it back if valid and within max_age.

2. Step 2: Analyze the try-except block

   If the token is valid and not expired, loads returns the original email, which is printed.

3. Final Answer:

   [e-mail] -> Option B

4. Quick Check:

   Valid token returns original email [OK]

Hint: Valid loads returns original data, else error [OK]

Common Mistakes:

• Assuming loads returns the secret key
• Confusing dumps and loads output
• Ignoring max_age expiration

4. Identify the error in this Flask password reset token verification code:

from itsdangerous import URLSafeTimedSerializer
serializer = URLSafeTimedSerializer('secret')
token = serializer.dumps('[e-mail]')

email = serializer.loads(token, max_age=3600)
print(email)

medium

A. Missing try-except block to handle expired or invalid tokens

B. Incorrect secret key used in serializer

C. Using dumps instead of loads to decode token

D. max_age parameter is not supported in loads

Solution

1. Step 1: Review the code for error handling

   The code calls loads without try-except, so expired or invalid tokens cause exceptions.

2. Step 2: Identify the missing safety measure

   Proper pattern uses try-except to catch exceptions and handle errors gracefully.

3. Final Answer:

   Missing try-except block to handle expired or invalid tokens -> Option A

4. Quick Check:

   Always catch exceptions when verifying tokens [OK]

Hint: Always wrap loads in try-except to catch errors [OK]

Common Mistakes:

• Not handling exceptions on token verification
• Confusing dumps and loads usage
• Assuming max_age is unsupported

5. You want to implement a password reset feature in Flask that sends a reset link with a token valid for 30 minutes. Which approach correctly combines token creation, expiration, and email sending?

hard

A. Store user password in token, send email with token, verify token by comparing passwords

B. Generate token with random string, send email with token, verify token by checking string length

C. Create a URLSafeTimedSerializer with secret key, generate token with dumps(user_email), send email with link containing token, verify token with loads(token, max_age=1800)

D. Create token with dumps(user_email), send email without token, verify token with loads(token, max_age=3600)

Solution

1. Step 1: Understand token creation and expiration

   Use URLSafeTimedSerializer with secret key to create a token from user email; set max_age to 1800 seconds (30 minutes) when verifying.

2. Step 2: Combine with email sending and verification

   Send the token in the reset link via email; verify token on reset page using loads with max_age to ensure expiration.

3. Final Answer:

   Create a URLSafeTimedSerializer with secret key, generate token with dumps(user_email), send email with link containing token, verify token with loads(token, max_age=1800) -> Option C

4. Quick Check:

   Serializer + dumps + max_age + email link = secure reset [OK]

Hint: Use serializer dumps and loads with max_age for timed tokens [OK]

Common Mistakes:

• Not setting max_age for token expiration
• Sending token without including it in email link
• Storing passwords in tokens