Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

E-Mail enumeration through the login form #15

Open
ProfessorLogout opened this issue Oct 6, 2022 · 0 comments
Open

E-Mail enumeration through the login form #15

ProfessorLogout opened this issue Oct 6, 2022 · 0 comments

Comments

@ProfessorLogout
Copy link

I've noticed, while building an app using django-magiclink, that the behavior of the Login view differs between a valid and invalid email addresses.
Depending on the context of the application this could be bad, as it enables third parties to enumerate valid account addresses.

Testing possible remediations I've subclassed the Login view in my app and do something like this currently:

class CustomLogin(Login):
    # ...
    def post(self, request, *args, **kwargs):
        logout(request)
        context = self.get_context_data(**kwargs)
        context['require_signup'] = settings.REQUIRE_SIGNUP
        form = LoginForm(request.POST)
        if not form.is_valid():
            if form.errors.get("email", False) and settings.NO_EMAIL_ENUMERATION:  # This could be a good setting to disable by default
                if len(form.errors) == 1:
                    sent_url = get_url_path(settings.LOGIN_SENT_REDIRECT)
                    return HttpResponseRedirect(sent_url)
                form.errors.pop("email")
            context['login_form'] = form
            return self.render_to_response(context)
        # ...

I'd be happy to contribute some improvements in that direction if this fits with whats best for the project, just let me know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant