Skip to content

Security: Prevent email enumeration on resend verification endpoint #1414

Description

@sahare77

Description
Currently, the /api/auth/resend-verification endpoint returns different messages depending on whether an email exists in our database or if it is already verified. This allows bad actors to perform "email enumeration" to figure out which users are registered on our platform.

Expected Behavior
The endpoint should return a generic success message (e.g., "If this email is registered and unverified, a verification link has been sent.") regardless of whether the user exists or is already verified.

Files to update:

  • backend/controllers/authController.js

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions