revert fake token getter in controller trait

Author: jrushlow

src/Controller/ResetPasswordControllerTrait.php

@@ -90,13 +90,4 @@ private function getSessionService(): SessionInterface
 
         return $request->getSession();
     }
-
-    /**
-     * Generate a fake token to be used in the session if needed to prevent
-     * revealing if a user exists.
-     */
-    private function getFakeToken(int $tokenLifetime): ResetPasswordToken
-    {
-        return new ResetPasswordToken('fake-token', new \DateTimeImmutable(\sprintf('+%d seconds', $tokenLifetime)), \time());
-    }
 }

src/ResetPasswordHelper.php

@@ -157,6 +157,11 @@ public function getTokenLifetime(): int
     /**
      * Generate a fake reset token.
      *
+     * Use this to generate a fake token so that you can, for example, show a
+     * "reset confirmation email sent" page that includes a valid "expiration date",
+     * even if the email was not actually found (and so, a true ResetPasswordToken
+     * was not actually created).
+     *
      * This method should not be used when timing attacks are a concern.
      */
     public function generateFakeResetToken(): ResetPasswordToken