Usernames Enumeration

[Spomky]

Is your feature request related to a problem? Please describe.
At the moment, the firewall triggers an error when a username does not exist. This could be used by an attacker to find usernames and associated key descriptors.

Describe the solution you'd like
No error should be triggered if the username does not exist.
A list of fake key descriptors should be generated. This list should be always the same for a given username.

[Spomky]

Partially fixed in Json Firewall (a9cd2f4)

[Spomky]

Recommendations added to the documentation

[AlexH-HankIT]

Is this still relevant with the current version? Looks like by default it is still possible to use this mechanism to determine which users do and do not exist.

[Spomky]

Yes it is and there is no efficient way to prevent it.
The Fake User Entity Support mentionned above has been removed in the last major release as this feature creates lot of issues.
Best is to let users to choose a username without any constraint and recommend them to avoid personal data e.g. real name or e-mail address.

[AlexH-HankIT]

OK, in my use case the username is pre determined anyway. Thanks for the quick response.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.