nodeSolidServer / node-solid-server

Solid server on top of the file-system in NodeJS
https://solidproject.org/for-developers/pod-server
Other
1.78k stars 299 forks source link

Username leakage from account creation #1771

Closed edwardsph closed 6 months ago

edwardsph commented 6 months ago

You can use account registration /register, to test whether or not usernames exist. If you tried to create an account with a username that exists, you get: image-20240312-175012 An alternative here would be to simply say "Account creation failed” and give no specific reason but that is not great for the user. Another option would be but to prevent a screen like this from being used to scrape usernames by putting in standard protections such as recaptcha.

This may take longer to resolve but could do with an immediate release since it is security related.

See also: https://github.com/nodeSolidServer/node-solid-server/issues/1758, https://github.com/nodeSolidServer/node-solid-server/issues/1770