TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-13 19:44:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
a1d24353db
zitadel/internal
History
Livio Spring a1d24353db
fix: prevent error reason leakage in case of IgnoreUnknownUsernames (#8372) 
# Which Problems Are Solved

ZITADEL administrators can enable a setting called "Ignoring unknown
usernames" which helps mitigate attacks that try to guess/enumerate
usernames. If enabled, ZITADEL will show the password prompt even if the
user doesn't exist and report "Username or Password invalid".
Due to a implementation change to prevent deadlocks calling the
database, the flag would not be correctly respected in all cases and an
attacker would gain information if an account exist within ZITADEL,
since the error message shows "object not found" instead of the generic
error message.

# How the Problems Are Solved

- Proper check of the error using an error function / type and
`errors.Is`

# Additional Changes

None.

# Additional Context

- raised in a support request

Co-authored-by: Silvan <silvan.reusser@gmail.com>
2024-07-31 14:23:57 +02:00
..
actions feat(actions): allow getting metadata of organizations from user grants (#7782) 2024-04-22 11:34:23 +00:00
activity fix: get orgID when missing on trigger logs (#7555) 2024-03-14 08:49:10 +00:00
admin/repository/eventsourcing feat(cmd): mirror (#7004) 2024-05-30 09:35:30 +00:00
api feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
auth/repository fix: prevent error reason leakage in case of IgnoreUnknownUsernames (#8372) 2024-07-31 14:23:57 +02:00
auth_request/repository fix(login): correctly reload policies on auth request (#7839) 2024-04-24 08:44:55 +00:00
authz fix(oidc): remove MFA requirement on ZITADEL API based on user auth methods (#8069) 2024-06-12 12:24:17 +00:00
command fix: prevent error reason leakage in case of IgnoreUnknownUsernames (#8372) 2024-07-31 14:23:57 +02:00
config feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
crypto refactor(database): exchange connection pool (#8325) 2024-07-17 15:16:02 +00:00
database fix: always use pgxpool config if MaxOpenConns isn't set (#8328) 2024-07-22 05:29:20 +00:00
domain fix: allow login with user created through v2 api without password (#8291) 2024-07-17 06:43:07 +02:00
eventstore refactor(database): exchange connection pool (#8325) 2024-07-17 15:16:02 +00:00
execution feat: add action v2 execution on requests and responses (#7637) 2024-05-04 11:55:57 +02:00
feature perf(import): optimize search for domains claimed by other organizations (#8200) 2024-07-05 09:36:00 +02:00
form refactor: rename package errors to zerrors (#7039) 2023-12-08 15:30:55 +01:00
i18n fix(middleware): init translation messages (#7778) 2024-04-16 12:08:18 +00:00
iam refactor: cleanup unused code (#7130) 2024-01-02 14:26:31 +00:00
id feat(cmd): Added machine ID mode to zitadel start up logs (#8251) 2024-07-16 09:53:57 +00:00
idp fix: encode ldap values to make valid UTF8 (#8210) 2024-06-28 13:46:54 +00:00
integration feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
logstore perf: project quotas and usages (#6441) 2023-09-15 16:58:45 +02:00
migration fix(setup): init projections (#7194) 2024-01-25 17:28:20 +01:00
net perf: project quotas and usages (#6441) 2023-09-15 16:58:45 +02:00
notification fix: sanitize output for email (#8373) 2024-07-31 14:21:10 +02:00
org refactor: cleanup unused code (#7130) 2024-01-02 14:26:31 +00:00
project refactor: cleanup unused code (#7130) 2024-01-02 14:26:31 +00:00
protoc merge main into next 2023-10-19 12:34:00 +02:00
qrcode docs(legal): Updated agreements and policies v2 (#3823) 2022-06-15 08:30:58 +02:00
query feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
renderer fix(login): (re)allow HTML in custom login texts (#7575) 2024-03-15 16:29:10 +01:00
repository feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
static feat: send test mail (#7968) 2024-06-20 19:51:42 +00:00
statik chore: initial version of a devcontainer (#6352) 2023-08-15 10:49:05 +02:00
telemetry feat: api v2beta to api v2 (#8283) 2024-07-26 22:39:55 +02:00
test refactor(fmt): run gci on complete project (#7557) 2024-04-03 10:43:43 +00:00
user fix: prevent error reason leakage in case of IgnoreUnknownUsernames (#8372) 2024-07-31 14:23:57 +02:00
v2 fix(v2): correct eventstore query (#8124) 2024-06-15 16:12:21 +03:00
view/repository refactor(fmt): run gci on complete project (#7557) 2024-04-03 10:43:43 +00:00
webauthn fix: allow other users to set up MFAs (#7914) 2024-05-07 05:38:26 +00:00
zerrors refactor(fmt): run gci on complete project (#7557) 2024-04-03 10:43:43 +00:00