dj-rest-auth
dj-rest-auth copied to clipboard
Email Enumeration on Registration Endpoint
Hi, thanks for creating this library. I'm using dj-rest-auth with allauth for registration.
When email is mandatory, registering with an existing email gives the message,
A user is already registered with this e-mail address.
Is there a way to make it always show success instead of revealing if an email already exists?
I noticed Allauth has the PREVENT_ENUMERATION
config variable set to True by default.
from allauth.account.views import RegisterView
from rest_framework.response import Response
from rest_framework import status
class RegisterView(RegisterView):
def create(self, request, *args, **kwargs):
response = super().create(request, *args, **kwargs)
# Always return a success response,
return Response({'detail': 'Registration successful'}, status=status.HTTP_201_CREATED)