Skip to content

auth

Two answers that should have been one

User enumeration, and the helpfulness that costs more than it gives.

Telling somebody which half of their login was wrong is a genuinely better experience, and it is why this defect keeps getting written. It is also an oracle: anybody can ask your application whether an address has an account, as many times as they like, and get a straight answer.

What that is worth depends on what your application is. For a bookshop, not much. For a service somebody might not want to be known to use, it is the whole breach.

  • POST /session

    An address that exists, with the wrong password.

  • POST /session

    An address that does not. Compare the two pairs.

A witness for this class is necessarily two requests, because a single response is not evidence of anything — the finding is that two responses differ when they should not. The console will let you send a sequence, and the engine compares the pair.

Registration and password reset are the two other endpoints with the same problem, and they are usually worse: a reset form that says 'we have sent you an email' either way is the pattern to copy.

This build

shop.example.com

Nothing sent yet. Every request goes to the application in this tab and nowhere else.