Request password reset returns internal server error when email address is not valid

[rachel-langford]

Every bug report should have precise description and reproduction steps; console traces or source code references are appreciated.

For assistance requests, contact Azure support or submit a post on Stack Overflow. We don't provide support through GitHub Issues. Feature requests can be raised on the Azure Feedback Forum.

Bug description

If a password reset is requested for an email address not registered on with API management, get "Server error. Unable to send request. Please try again later"

Reproduction steps

1. Go to forgot password
2. enter a email address that is not valid for any user
3. enter the characters
4. click request reset
5. Server error is returned

Expected behavior

Same as if it was a valid email address. The site shouldn't error - could be used to compromise system if can identify valid vs non valid email addresses registered.

Is your portal managed or self-hosted?

Managed

Release tag or commit SHA (if using self-hosted version)

NA

API Management service name

emi

Environment

Chrome / Windows 10

Additional context

[azaslonov]

Hi Rachel, thanks for reporting the issue. We would need your APIM service name to investigate it. Please send it to [email protected].

[rachel-langford]

Have emailed (it's emi, as mentioned above)

[ygrik]

@rachel-langford thank you, we will enhance this behavior in the next managed version release

[antonsalimAU]

Please reopen this issue, as it has not been solved.

[msftbot[bot]]

By adding this issue to the Backlog project, we have prioritized it for development. You can monitor its status in the project's board.

[mikebudzynski]

@antonsalimAU, we will soon start working on a fix and it will likely be deployed in the first quarter of 2022.

[ChrisZevenbergenNavara]

Is there an update on this?

[mikebudzynski]

@harunrst Has this improvement been implemented?