username leak. remove "user found" from login page

nodeSolidServer / node-solid-server

Solid server on top of the file-system in NodeJS

https://solidproject.org/for-developers/pod-server

Other

1.78k stars 299 forks source link

username leak. remove "user found" from login page #1758

Closed emmettownsend closed 7 months ago

emmettownsend commented 7 months ago

anyone can scrape usernames from an NSS service by using the login page, since it discloses “user found”. (CWE - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (4.13) ) Screenshot from 2024-02-20 14-03-27

emmettownsend commented 7 months ago

Davi found this defect yesterday. Looks like it could be fixed by just changing the error message sent back to the browser to something like...'The username and password combination is not valid'

bourgeoa commented 7 months ago

Thanks for reporting.