Skip to content
This repository has been archived by the owner on Jul 30, 2024. It is now read-only.

Unambiguous non-existent user/invalid password messages via JSON. #673

Open
usrbinsam opened this issue Jul 2, 2017 · 1 comment · May be fixed by #802
Open

Unambiguous non-existent user/invalid password messages via JSON. #673

usrbinsam opened this issue Jul 2, 2017 · 1 comment · May be fixed by #802

Comments

@usrbinsam
Copy link

In addition to #357, Flask-Security gives attackers hints to whether the username or password is invalid. Even if you change SECURITY_MSG_USER_DOES_NOT_EXIST and SECURITY_MSG_INVALID_PASSWORD to use ambiguous wording, talking to the login view via JSON (for example) will still give hints whether the email or password is incorrect.

For an invalid password, the response looks like:

{'meta': {'code': 400},
 'response': {'errors': {'password': ['Invalid username or password']}}}

And a non existent user:

{'meta': {'code': 400},
 'response': {'errors': {'email': ['Invalid username or password']}}}
@jirikuncar
Copy link
Contributor

@miniCruzer we should change the field validators to form validators.

@boytm boytm linked a pull request Sep 9, 2018 that will close this issue
Open
boytm added a commit to boytm/flask-security that referenced this issue Oct 13, 2018
@boytm
Add option SECURITY_LOGIN_SHOW_USER_EXISTENCE to hide 'user does not …
21a0c58 
…exist' in /login error message, fix pallets-eco#673
jasco pushed a commit to jasco/flask-security that referenced this issue Oct 3, 2023
@jwag956
Perms (pallets-eco#675)
aba7b66 
* Fix backwards compat issues with permissions.

Now - if an app uses fsqla_vX it just works.
Added description in CHANGES on how apps that don't use fsqla_vX need to be modified.

Added some tests to verify working with older DBs.

The fsqlalchemy example was crazy - trying to use mocks made everything very complex. Converted to a simpler in-memory DB style testing.

closes pallets-eco#673
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add option SECURITY_LOGIN_SHOW_USER_EXISTENCE to hide 'user does not … boytm/flask-security
2 participants
@jirikuncar @usrbinsam