#31505: Document possible email address enumeration in PasswordResetView.
-------------------------------------+-------------------------------------
Reporter: Mohammad Almazroa | Owner: felixxm
Type: | Status: assigned
Cleanup/optimization |
Component: Documentation | Version: 3.0
Severity: Normal | Resolution:
Keywords: User Enumeration | Triage Stage: Accepted
Security Bug |
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Mohammad Almazroa):
Replying to [comment:5 Florian Apolloner]:
> Replying to [ticket:31505 Mohammad Almazroa]:
> > Remediation:
> > Set up a random sleep time when the email does not exists. The
response time of correct and incorrect email should be the same.
>
> This is not a remediation, you can average that out with a few requests…
A random sleep time should be within the range that the
"PasswordResetView" is taking to send an email. This way it is not clear
what response time that means valid or not valid email.
That is just an idea, if you have something better I think we should do
it.
--
Ticket URL: <https://code.djangoproject.com/ticket/31505#comment:6>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.6064bdfd994ae4f7a9f32b67f33ac778%40djangoproject.com.
