nodeSolidServer/node-solid-server

username leak. remove "user found" from login page

Closed this issue · 2 comments

anyone can scrape usernames from an NSS service by using the login page, since it discloses “user found”. (CWE - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (4.13) )
Screenshot from 2024-02-20 14-03-27

Davi found this defect yesterday.
Looks like it could be fixed by just changing the error message sent back to the browser to something like...'The username and password combination is not valid'

Thanks for reporting.