[Security] Unify auth failure message to prevent user enumeration#458
[Security] Unify auth failure message to prevent user enumeration#458advikdivekar wants to merge 1 commit into
Conversation
Returning distinct messages ('Email is invalid' vs 'Invalid password')
let attackers automate POST /api/auth/login across an email list and
determine which addresses are registered purely from the response body.
Both failure paths now return 'Invalid credentials' so no information
about account existence is revealed to the caller.
Fixes GitMetricsLab#445
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 56 minutes and 29 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Review failedAn error occurred during the review process. Please try again later. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@mehul-m-prajapati why was my code not merged? did i make any mistakes in my code? please let me know |
2 participants
Problem
backend/config/passportConfig.jsreturned two distinct error messages from the login strategy:'Email is invalid '— when no account matched the submitted email'Invalid password'— when the email existed but the password was wrongAny unauthenticated caller could automate
POST /api/auth/loginacross a list of email addresses and, purely from the response body, determine which ones are registered in the database. With the wildcard CORS policy that was in place, this enumeration could be driven from any webpage with no browser restriction whatsoever. The harvested list is directly usable for targeted phishing, credential-stuffing against other services, or identifying high-value accounts.Changes
backend/config/passportConfig.js'Email is invalid '→'Invalid credentials''Invalid password'→'Invalid credentials'Both failure paths now return the identical generic message. The caller learns only that authentication failed — nothing about whether the email is registered.
Why this approach fixes the root cause
User enumeration works because the attacker can distinguish two states. Collapsing both failure cases to one identical message removes the signal entirely. This is the industry-standard approach (used by every major auth provider) and requires no additional infrastructure — it is a two-line change at the point where the distinction is generated.
Steps to test
npm startinbackend/).POST /api/auth/loginwith an email that does not exist in the database and any password.{ "message": "Invalid credentials" }POST /api/auth/loginwith a registered email and a wrong password.{ "message": "Invalid credentials" }POST /api/auth/loginwith correct credentials — login succeeds as normal.Edge cases covered
Invalid credentialsInvalid credentials200 Login successful(unchanged)'Email is invalid 'string (a latent bug) is also removed.Regression check
Only
passportConfig.jsis modified. No route handlers, middleware, session logic, or tests are changed. The successful login path (return done(null, { id, username, email })) is untouched.Please review and merge this under GSSoC 2026.