Skip to content

E-Mail enumeration through the login form #15

Description

@ProfessorLogout

I've noticed, while building an app using django-magiclink, that the behavior of the Login view differs between a valid and invalid email addresses.
Depending on the context of the application this could be bad, as it enables third parties to enumerate valid account addresses.

Testing possible remediations I've subclassed the Login view in my app and do something like this currently:

class CustomLogin(Login):
    # ...
    def post(self, request, *args, **kwargs):
        logout(request)
        context = self.get_context_data(**kwargs)
        context['require_signup'] = settings.REQUIRE_SIGNUP
        form = LoginForm(request.POST)
        if not form.is_valid():
            if form.errors.get("email", False) and settings.NO_EMAIL_ENUMERATION:  # This could be a good setting to disable by default
                if len(form.errors) == 1:
                    sent_url = get_url_path(settings.LOGIN_SENT_REDIRECT)
                    return HttpResponseRedirect(sent_url)
                form.errors.pop("email")
            context['login_form'] = form
            return self.render_to_response(context)
        # ...

I'd be happy to contribute some improvements in that direction if this fits with whats best for the project, just let me know.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions