-
Notifications
You must be signed in to change notification settings - Fork 303
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Username leakage from password reset mechanism #1770
Comments
It seems strange to have a What do you think of sending : |
The best practice recommendation is that the response is the same either way as in https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html |
Hello Alain, If the change needs to be made I already found the code which would be edited to fix. node-solid-server/lib/requests/password-reset-email-request.js Lines 92 to 98 in d8290cb
Simply applying renderSuccess() on the final then and catch would suffice, though it may warrant renaming the method. Edit: Another option is rendering the same view for success and failure but having a debug message which indicates success or failure to individuals developing their own server. |
I would do it by replacing that line
this will maintain all the logic, and I will add a comment line, why there is no throw Error Please do a PR |
In Reset Password
/account/password/reset
, if you enter a valid username you getAn invalid username results in
This can be used to confirm whether or not a username exists. It would be better if both cases resulted in the same message. That could be the original message or perhaps "A Reset Password link has been sent to the email associated with this username"
This is a simple fix but as it is a security issue, please could you do an immediate release.
See also: #1758
The text was updated successfully, but these errors were encountered: