[jira] [Commented] (SYNCOPE-1973) Security auth user enumeration hardening

[ASF subversion and git services (Jira)]

    [ 
https://issues.apache.org/jira/browse/SYNCOPE-1973?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18089112#comment-18089112
 ] 

ASF subversion and git services commented on SYNCOPE-1973:
----------------------------------------------------------

Commit 076bb6dc70290ed1cea64b2478dbd055e29b136b in syncope's branch 
refs/heads/4_1_X from Massimiliano Perrone
[ https://gitbox.apache.org/repos/asf?p=syncope.git;h=076bb6dc70 ]

[SYNCOPE-1973] Align FIT expectations with generic authentication errors


>   Security auth user enumeration hardening
> ------------------------------------------
>
>                 Key: SYNCOPE-1973
>                 URL: https://issues.apache.org/jira/browse/SYNCOPE-1973
>             Project: Syncope
>          Issue Type: Improvement
>            Reporter: Massimiliano Perrone
>            Assignee: Massimiliano Perrone
>            Priority: Major
>             Fix For: 4.1.2, 5.0.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Authentication failure responses should be hardened to avoid exposing 
> credential-specific details that could help an attacker distinguish between 
> unknown users, invalid passwords, or other authentication failure causes.
> Add a configurable option to return a generic authentication failure message 
> for username/password authentication errors, while preserving backward 
> compatibility for existing deployments.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)