Repository navigation
Security fix: forgot password and sign-up give one answer for every email - #314
Merged
Merged
Conversation
Security fix. The sign-in page showed a different sentence for each forgot-password case (has an account, on the team without one, invited, not on this install), so anyone could learn which emails have accounts or are on the team. Forgot password now says the same for everyone: "If <email> can sign in here, we've sent a reset code or a set-up link." It names both senders from /auth/methods, says to check spam or quarantine or ask IT to allow those addresses, and always moves on to the reset code, with a note that a set-up link may have come instead. Sign-up from an invite link on a self-hosted install reads the same way: "If <email> can join here, we've sent a verification code."
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security fix. Since #311 the sign-in page showed a different sentence for each forgot-password case (has an account, on the team without one, invited, not on this install). Anyone could use it to learn which emails have accounts or are on the team. The page now gives one answer for every email, and so does sign-up from an invite link on a self-hosted install.
Changes
/auth/methods: "Reset codes come from ." and "Set-up links come from .", then "Not in your inbox after a few minutes? Check spam or quarantine, or ask IT to allow those addresses."ForgotStatusis now onlysent. The error box hasdata-testid="auth-error"for tests.Verification
npm run lint,npm run typecheck, staticnpm run build.sign-in-methods.spec.ts,mobile-sign-in.spec.ts(22 passed),audit-shell.spec.ts(36 passed).sent, plus each per-case status an older gateway gave) render the same message, sender lines, next step and no error. Also: an SES sender for Cognito shows that address, and self-hosted sign-up shows the one answer.