cms icon indicating copy to clipboard operation
cms copied to clipboard

Prevent email enumeration on public registration

Open timkelty opened this issue 10 months ago • 0 comments

Description

On a public registration form, email addresses can be leaked via enumeration when an existing email is entered. When this happens, this PR will respond as though the user successfully registered – but instead of saving the user and sending an activation email, it will send an email verification to the existing user.

Questions

Is sending an activation email enough, or do we need a dedicated system message for this?

timkelty avatar Apr 14 '25 23:04 timkelty