Livio Spring ae1e86ed9a

fix(login): remove normalization to prevent username enumeration ...

# Which Problems Are Solved

The username entered by the user was resp. replaced by the stored user's username. This provided a possibility to enumerate usernames as unknown usernames were not normalized.

# How the Problems Are Solved

- Store and display the username as entered by the user.
- Removed the part where the loginname was always set to the user's loginname when retrieving the `nextSteps`

# Additional Changes

None

# Additional Context

None

(cherry picked from commit 14de8ecac2afafee4975ed7ac26f3ca4a2b0f82c)

2025-03-31 12:49:55 +02:00

..

eventsourcing

fix(login): remove normalization to prevent username enumeration

2025-03-31 12:49:55 +02:00

auth_request.go

feat: add PKCE option to generic OAuth2 / OIDC identity providers (#9373)

2025-02-26 12:20:47 +00:00

org.go

feat(login): use new IDP templates (#5315)

2023-02-28 21:20:58 +01:00

refresh_token.go

chore: upgrade to oidc v2 release (#5437)

2023-03-28 11:28:56 +00:00

repository.go

fix: move activity log to queries and remove old code (#3096)

2022-01-26 10:16:33 +01:00

token.go

feat(eventstore): increase parallel write capabilities (#5940)

2023-10-19 12:19:10 +02:00

user_session.go

refactor: cleanup unused code (#7130)

2024-01-02 14:26:31 +00:00

user.go

feat(OIDC): add back channel logout (#8837)

2024-10-31 15:57:17 +01:00