mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-06 10:13:16 +00:00
d537e86345
# Which Problems Are Solved
When authenticating with email or phone number in the login V1, users
were not able to request a password reset and would be given a "User not
found" error.
This was due to a check of the loginname of the auth request, which in
those cases would not match the user's stored loginname.
# How the Problems Are Solved
Switch to a check of the resolved userID in the auth request. (We still
check the user again, since the ID might be a placeholder for an unknown
user and we do not want to disclose any information by omitting a check
and reduce the response time.)
# Additional Changes
None
# Additional Context
- reported through support
- requires backport to v3.x
(cherry picked from commit ffe6d41588)
41 lines
1.5 KiB
Go
41 lines
1.5 KiB
Go
package login
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
const (
|
|
tmplPasswordResetDone = "passwordresetdone"
|
|
)
|
|
|
|
func (l *Login) handlePasswordReset(w http.ResponseWriter, r *http.Request) {
|
|
authReq, err := l.ensureAuthRequest(r)
|
|
if err != nil {
|
|
l.renderError(w, r, authReq, err)
|
|
return
|
|
}
|
|
// We check if the user really exists or if it is just a placeholder or an unknown user.
|
|
// In theory, we could also check for the unknownUserID constant. However, that could disclose
|
|
// information about the existence of a user to an attacker if they check response times,
|
|
// since those requests would take shorter than the ones for real users.
|
|
user, err := l.query.GetUserByID(setContext(r.Context(), authReq.UserOrgID), true, authReq.UserID)
|
|
if err != nil {
|
|
if authReq.LoginPolicy.IgnoreUnknownUsernames && zerrors.IsNotFound(err) {
|
|
err = nil
|
|
}
|
|
l.renderPasswordResetDone(w, r, authReq, err)
|
|
return
|
|
}
|
|
_, err = l.command.RequestSetPassword(setContext(r.Context(), authReq.UserOrgID), user.ID, authReq.UserOrgID, domain.NotificationTypeEmail, authReq.ID)
|
|
l.renderPasswordResetDone(w, r, authReq, err)
|
|
}
|
|
|
|
func (l *Login) renderPasswordResetDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) {
|
|
translator := l.getTranslator(r.Context(), authReq)
|
|
data := l.getUserData(r, authReq, translator, "PasswordResetDone.Title", "PasswordResetDone.Description", err)
|
|
l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplPasswordResetDone], data, nil)
|
|
}
|