Skip to content
This repository was archived by the owner on Apr 26, 2024. It is now read-only.

Return the same error message from /login when password is incorrect and when account doesn't exist. #12738

Merged
merged 6 commits into from
Jun 7, 2022
Merged

Return the same error message from /login when password is incorrect and when account doesn't exist. #12738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
677c763
Upon 403 login attempt by unregistered user return Invalid Password
Danieloni1 May 15, 2022
f5b8a90
Changelog for PR #12738.
Danieloni1 May 17, 2022
2232b1d
Constant Invalid username or password message + CL
Danieloni1 Jun 7, 2022
3a9fa27
Lint modifications.
Danieloni1 Jun 7, 2022
a80db50
Merge https://github.com/matrix-org/synapse into daniel-aloni/threepi…
Danieloni1 Jun 7, 2022
3a247a0
Merge branch 'develop' into daniel-aloni/threepid-login-error
Danieloni1 Jun 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/12738.misc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Report login failures due to unknown third party identifiers in the same way as failures due to invalid passwords. This prevents an attacker from using the error response to determine if the identifier exists. Contributed by Daniel Aloni.
8 changes: 6 additions & 2 deletions synapse/handlers/auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@

logger = logging.getLogger(__name__)

INVALID_USERNAME_OR_PASSWORD = "Invalid username or password"


def convert_client_dict_legacy_fields_to_identifier(
submission: JsonDict,
Expand Down Expand Up @@ -1215,7 +1217,9 @@ async def validate_login(
await self._failed_login_attempts_ratelimiter.can_do_action(
None, (medium, address)
)
raise LoginError(403, "", errcode=Codes.FORBIDDEN)
raise LoginError(
403, msg=INVALID_USERNAME_OR_PASSWORD, errcode=Codes.FORBIDDEN
)

identifier_dict = {"type": "m.id.user", "user": user_id}

Expand Down Expand Up @@ -1341,7 +1345,7 @@ async def _validate_userid_login(

# We raise a 403 here, but note that if we're doing user-interactive
# login, it turns all LoginErrors into a 401 anyway.
raise LoginError(403, "Invalid password", errcode=Codes.FORBIDDEN)
raise LoginError(403, msg=INVALID_USERNAME_OR_PASSWORD, errcode=Codes.FORBIDDEN)

async def check_password_provider_3pid(
self, medium: str, address: str, password: str
Expand Down