Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability - Username cycling #771

Closed
JeremykJAC opened this issue Apr 30, 2021 · 2 comments · Fixed by #775
Closed

Vulnerability - Username cycling #771

JeremykJAC opened this issue Apr 30, 2021 · 2 comments · Fixed by #775
Assignees
@HalcyonJAC

Comments

@JeremykJAC
Copy link

JeremykJAC commented Apr 30, 2021 •
edited
Loading

When attempting to sign-in with an invalid email address the following error appears:

1.png

When attempting to sign-in with a valid email but invalid password the following error appears:

2.png

The error message changes depending on whether the email address entered is for a registered user account or not. This means that a bad actor could cycle email addresses until they discover a valid one.
@JeremykJAC
Copy link
Author

JeremykJAC commented May 7, 2021 •
edited
Loading

When a user enters an incorrect email and/or password they will now get the same error message. Meaning it is now harder to username cycle.

image (5).png![image

@JeremykJAC
Copy link
Author

We haven't made all errors generic, the system still warns for poorly formatted email addresses, for example.

image (4).png

@HalcyonJAC HalcyonJAC mentioned this issue May 12, 2021
Merged
3 tasks
KateMJAC pushed a commit that referenced this issue May 20, 2021
@HalcyonJAC @warrensearle
#771 Authentication Generic Errors (#775)
e53f88b 
* Display a generic erorr for wrong password or user not found

* Update SignIn.vue

replicating changes from local copy due to a 403 error

* adding lodash as explicit dependency

Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>
lloback pushed a commit that referenced this issue Jul 20, 2021
@HalcyonJAC @warrensearle @lloback
#771 Authentication Generic Errors (#775)
d2a8a7a 
* Display a generic erorr for wrong password or user not found

* Update SignIn.vue

replicating changes from local copy due to a 403 error

* adding lodash as explicit dependency

Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>
joy-ade pushed a commit that referenced this issue Aug 10, 2021
@lloback @warrensearle
@tomlovesgithub @mbrookeswebdev @HalcyonJAC
Apply/517 qt analytics - save History and session time (#774)
d206768 
* 517 Collect more detailed history of qualifying test responses
- Save history
	- on Exit Modal
	- on information page
	- on review
	- on Situational Judgement
- Save session
	- on skip
	- on SAve

* Disable circleci config

* Include CODEOWNERS

* digital-platform#305 Include pull request template

* Include lint and test in PR workflow

* Fix the broken preview URLs and workflow (#752)

* Small change to test broken

* Preview workflow should use node 10, for now

* Update package-lock

* Small change to test fixed

* test to fix

Co-authored-by: Tom Russell <TR115251@hotmail.co.uk>

* #729 Fixed errors on Qualifications page (#734)

* #729 Fixed errors on Qualifications page

* #729 Changes as per PR comments

Co-authored-by: Maria Brookes <maria_brookes@yahoo.co.uk>
Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>

* #708 account creation issues (#751)

* Add await into account creation - improve password validation

* sort sign-in chronology

* add and fix password tests

* Add await into account creation - improve password validation

* sort sign-in chronology

* add and fix password tests

* fix signUp test

Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>

* #720 Added a message if vacancy was unpublished (#732)

* #720 Added a message if vacancy was unpublished

* #720 Display message if vacancy unpublished

* Made changes to make applications appear

* Made changes to make applications appear

* Made changes to make applications appear

* WIP

* #720 Made changes to accommodate unpublished vacancy

Co-authored-by: Maria Brookes <maria_brookes@yahoo.co.uk>
Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>

* Update github workflow files

* Bump version number to 1.39.0

* Remove circleCI config

* Update README.md

* Bump version number to 1.40.0

* Update workflows to target staging and production

* Bump version number to 1.39.0

* Remove name-blind sift and phone assessment from timeline (#753)

* remove name-blind sift and phone assessment from timeline

* fix timeline tests

* delete commented code

Co-authored-by: HalcyonJAC <79906532+HalcyonJAC@users.noreply.github.com>

* Security/769 weak passwords allowed in reset form (#778)

* Reset PW component with proper validation

* check for valid action code

* #771 Authentication Generic Errors (#775)

* Display a generic erorr for wrong password or user not found

* Update SignIn.vue

replicating changes from local copy due to a 403 error

* adding lodash as explicit dependency

Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>

* #1289 Remove gaps in employment from non-legal exercises (#761)

* inital changes

* Update readme

* remove commented code

Co-authored-by: Warren Searle <warren@precise-minds.co.uk>

* #1313 Location preferences (#777)

* wip

* wip

* ranked choice changes

* remove unrelated changes

* remove padding

* remove phantom checkbox

* add to review page

* remove from review page [wrong branch]

Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>

* Workflow: on merge. Change develop to main branch

* Bump version number to 1.40.0

* 517 Collect more detailed history of qualifying test responses
- Save history
	- on Exit Modal
	- on information page
	- on review
	- on Situational Judgement
- Save session
	- on skip
	- on SAve

* [517] fix anlytics

* [517] resolve conflict package-lock

Co-authored-by: Lisias (Lee) Loback <lisias@loback.co.uk>
Co-authored-by: Warren Searle <warren@precise-minds.co.uk>
Co-authored-by: warrensearle <warren.searle@judicialappointments.digital>
Co-authored-by: Tom Russell <TR115251@hotmail.co.uk>
Co-authored-by: Maria Brookes <40855898+mbrookeswebdev@users.noreply.github.com>
Co-authored-by: Maria Brookes <maria_brookes@yahoo.co.uk>
Co-authored-by: tomlovesgithub <44227249+tomlovesgithub@users.noreply.github.com>
Co-authored-by: HalcyonJAC <79906532+HalcyonJAC@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@HalcyonJAC HalcyonJAC

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

#771 Authentication Generic Errors jac-uk/apply
2 participants
@JeremykJAC @HalcyonJAC