Description
Currently, the /api/auth/resend-verification endpoint returns different messages depending on whether an email exists in our database or if it is already verified. This allows bad actors to perform "email enumeration" to figure out which users are registered on our platform.
Expected Behavior
The endpoint should return a generic success message (e.g., "If this email is registered and unverified, a verification link has been sent.") regardless of whether the user exists or is already verified.
Files to update:
backend/controllers/authController.js
Description
Currently, the
/api/auth/resend-verificationendpoint returns different messages depending on whether an email exists in our database or if it is already verified. This allows bad actors to perform "email enumeration" to figure out which users are registered on our platform.Expected Behavior
The endpoint should return a generic success message (e.g., "If this email is registered and unverified, a verification link has been sent.") regardless of whether the user exists or is already verified.
Files to update:
backend/controllers/authController.js