eddyystop / feathers-service-verify-reset

Adds sign up email verification, forgotten password reset, and other capabilities to local feathers-authentication
MIT License
33 stars 7 forks source link

Error message on 'forgotten password' reveals that the user exists #26

Open kbonev opened 4 years ago

kbonev commented 4 years ago

I have not been able to turn off the error message that the user hasn't verified their email address when using 'Forgotten password' functionality.

This is deemed a security issue as that response/error verifies that there is such user account compared to the lack of it when the email is invalid.

Steps:

  1. User has forgotten password - makes a request through front-end or postman
  2. If user's email is not verified, the response indicates so = confirms the user has an account on the system If user is not a user, the error is 'User not found', which confirms the user isn't there.

Is there to blank out the errors by passing a configuration parameter. I've been through the documentation but haven't seen such consideration. Penetration tests deem this to be low to medium severity issue and I was hoping there is a parameterised fix for it - similar to an always valid generic message - "Check your inbox, in case of problem, please contact support".