Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better error messages for failed logins #2924

Open
JarrydLong opened this issue Mar 29, 2024 · 1 comment
Open

Better error messages for failed logins #2924

JarrydLong opened this issue Mar 29, 2024 · 1 comment

Comments

@JarrydLong
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Our error messages indicate if an account exists or not when trying to login which can result in a user enumeration attack.

It makes it easy to determine if the account that is being tested exists or not and then take it further.

Steps to reproduce:

  1. Navigate to Login Page
  2. Click on forgot password
  3. Enter an invalid email address
  4. Error Message: " This email address does not exist in our database! "
  5. Now enter a valid Email
  6. The Message is different

Describe the solution you'd like
We follow the same wording as WordPress core does however further discussion needs to be had around this

Additional context
Reported by Bullet / FS - 124740

@andrewlimaza
Copy link
Contributor

andrewlimaza commented Apr 22, 2024

This follows default WordPress core behavior, we rely on the WordPress login form for processing the login including failed logins and error messages.

However if it's concerning, developers may use the login_errors hook to create custom error messages - https://developer.wordpress.org/reference/hooks/login_errors/

Here are the screenshots for reference.
Screenshot 2024-04-22 at 11 02 16
Screenshot 2024-04-22 at 11 02 31

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants