Fix user enumeration attack vulnerability in /auth/forgotpw

[xx4h]

Currently it is possible to find valid user accounts by bruteforcing /auth/forgotpw.

I understand the convenience of being always told what the problem is (from the user perspective), but at least some of us (or maybe even the most of us) use mokey to provide a self-service portal to an unsecure network or even expose it to the internet, which is why we should at least make this configurable.

Would be happy to get some more thoughts and opinions on this.

Cheers
- xx4h

[aebruno]

Agreed. This should probably always return success (from the user perspective) and just do nothing on the backend if and invalid user account was provided. Having this configurable would be nice. We do have some rudimentary rate limiting in mokey as well which makes brute forcing forgotpw slightly more challenging. If enabled, by default it only allows 15 POST requests per hour.

[xx4h]

Quite some time passed, since i initially raised that 😅

Unfortunately now it has become even easier to find valid user accounts, as we directly get feedback about if a username is valid or not on the /auth/login page.

[aebruno]

Quite some time passed, since i initially raised that 😅

Unfortunately now it has become even easier to find valid user accounts, as we directly get feedback about if a username is valid or not on the /auth/login page.

We've found the current login flow to be a bit easier for end users with the trade off that it does expose the potential for username enumeration attack. If this is a concern for your site the recommendation is to enable rate limiting which would mitigate this attack somewhat as the attacker could only do a limited number of posts per hour.

We are certainly open to hearing alternative implementation suggestions or other mitigation strategies if you have any.