Don't leak information about the existence of accounts in SessionsController #1600
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
moritzhoeppner
force-pushed
the
paranoid-sessions-controller
branch
2 times, most recently
from
11091de to
f6d9f84
Compare
MaicolBen
reviewed
Jun 2, 2023
| if @resource.respond_to?(:locked_at) && @resource.locked_at | ||
| render_create_error_account_locked | ||
| else | ||
| render_create_error_not_confirmed | ||
| end | ||
| else | ||
| # In order to avoid timing attacks in paranoid mode, we want the password hash to be |
There was a problem hiding this comment.
can you move this new code and explanation to another method so doesn't make bigger than it's?
There was a problem hiding this comment.
Hi, thanks for the review :)
I moved the code in a new method and also took the liberty to refactor the beginning of the create method a bit. Hope that's fine.
…Auth::SessionsController
moritzhoeppner
force-pushed
the
paranoid-sessions-controller
branch
from
9f7a272 to
2ba1ef7
Compare
ThiagoAnunciacao
pushed a commit
to ThiagoAnunciacao/devise_token_auth
that referenced
this pull request
Jul 6, 2023
…troller (lynndylanhurley#1600) * Don't leak information about the existence of accounts in DeivseTokenAuth::SessionsController * Refactor SessionsController
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The SessionsController leaks information about the existence of accounts even if Devise's paranoid mode is activated. It leaks this information in the following ways:
The pull request fixes these issues by: