Option to disable password reset / only send emails for existing accounts (bot spam issue)

[epinox]

Hi,

I’ve noticed through server log entries that bots are actively abusing the /accounts/password/reset/ endpoint to send large numbers of password reset emails (spam / email bombing).

As a temporary workaround I’m currently blocking the page at the Apache2 level.

Would it be possible to add a configuration option to either:
Completely disable the password reset functionality, or
Only send a password reset email if the submitted email address actually exists in the database?

In the second case, the response should remain the same whether the email exists or not (no indication that the address is unknown), in order to prevent account enumeration.

[mgogoulos]

Hi
there's a setting that does this, sends email only if the address exists. You can set

ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS = False

(it's True by default)

Also allauth already sets some rate limits that you might be interested to check - https://docs.allauth.org/en/dev/account/rate_limits.html

[epinox]

Thank you!

ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS = False is exactly what I was looking for. I’ll set that and also check the rate limits.

Really appreciate the quick and helpful reply!