Then, in your reset handler:

33hkr isn’t a bug. It’s a breadcrumb.

The Anatomy of a Password Reset: Breaking Down the “33hkr” Edge Case

Most teams fail at #3. They assume the session cookie will carry the shard context. But during a password reset, the user is logged out . There is no session. The shard context must travel inside the reset link itself. Don’t do this: https://yourapp.com/reset?token=eyJhbGciOi...