Skip to content
This repository has been archived by the owner on Aug 8, 2020. It is now read-only.

Send 404 on wrong password and/or non-existing username #58

Open
Mondei1 opened this issue Mar 17, 2019 · 1 comment
Open

Send 404 on wrong password and/or non-existing username #58

Mondei1 opened this issue Mar 17, 2019 · 1 comment
Labels
enhancement New feature or request vulnerability Security vulnerability or solution for one
Milestone
v1.0-RELEASE

Comments

@Mondei1
Copy link
Member

Mondei1 commented Mar 17, 2019

For security reasons we have to lie to the user on login. If a user enters the wrong username or password the backend should return 404 or 401 in both cases. If the user has 2FA set upped, the "Enter your 2FA code" (or something) should be prompted and then, If the code is right or not, the message "Wrong password or username" is showing up.

The reason for this is because a hacker would not now If the data he put in is right or not. Currently it's user-friendly, but bad security practice.
@Mondei1 Mondei1 added enhancement New feature or request vulnerability Security vulnerability or solution for one labels Mar 17, 2019
@Mondei1 Mondei1 added this to the v1.0-RELEASE milestone Mar 17, 2019
@ghost
Copy link

ghost commented Mar 17, 2019

2FA is not set up and will not within the next releases.
But yes, it's perfectly normal to just send a "404", regardless of if an user exists or the entered password is wrong :)

@ghost ghost changed the title Lie on login Send 404 on wrong password and non-existing username Mar 17, 2019
@ghost ghost changed the title Send 404 on wrong password and non-existing username Send 404 on wrong password and/or non-existing username Apr 16, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
enhancement New feature or request vulnerability Security vulnerability or solution for one
Projects
None yet
Milestone
v1.0-RELEASE
Development

No branches or pull requests
1 participant
@Mondei1