server/AyaNova/Controllers/AuthController.cs

@@ -368,6 +368,13 @@ namespace AyaNova.Api.Controllers
                 return StatusCode(401, new ApiErrorResponse(ApiErrorCode.AUTHENTICATION_FAILED));
             }
 
+            if (string.IsNullOrWhiteSpace(user.PasswordResetCode) || user.PasswordResetCodeExpire == null)
+            {
+                //Make a fail wait
+                await Task.Delay(nFailDelay);
+                return StatusCode(401, new ApiErrorResponse(ApiErrorCode.AUTHENTICATION_FAILED));
+            }
+            
             //vet the expiry
             var utcNow = new DateTimeOffset(DateTime.Now.ToUniversalTime(), TimeSpan.Zero);
             if (user.PasswordResetCodeExpire < utcNow.DateTime)
@@ -384,7 +391,7 @@ namespace AyaNova.Api.Controllers
 
         /// <summary>
         /// Generate time limited password reset code for User
-        /// and email to them
+        /// and email link to them so they can set their password
         /// 
         /// </summary>
         /// <param name="id">User id</param>