[
https://issues.apache.org/jira/browse/SYNCOPE-1973?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18089107#comment-18089107
]
ASF subversion and git services commented on SYNCOPE-1973:
----------------------------------------------------------
Commit 9eb39b482d60b2379438295f705904859b5242b1 in syncope's branch
refs/heads/master from Massimiliano Perrone
[ https://gitbox.apache.org/repos/asf?p=syncope.git;h=9eb39b482d ]
[SYNCOPE-1973] Avoid exposing authentication error details that enable user
enumeration (#1414)
> Security auth user enumeration hardening
> ------------------------------------------
>
> Key: SYNCOPE-1973
> URL: https://issues.apache.org/jira/browse/SYNCOPE-1973
> Project: Syncope
> Issue Type: Improvement
> Reporter: Massimiliano Perrone
> Assignee: Massimiliano Perrone
> Priority: Major
> Fix For: 4.0.7, 4.1.2, 5.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Authentication failure responses should be hardened to avoid exposing
> credential-specific details that could help an attacker distinguish between
> unknown users, invalid passwords, or other authentication failure causes.
> Add a configurable option to return a generic authentication failure message
> for username/password authentication errors, while preserving backward
> compatibility for existing deployments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
