changeEmail attack surface
🤔Question✅Solved
Hello, I noticed that when using the "authClient.changeEmail", it returns a base error "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL" if the email already exists. As this exposes an attack surface for user account email enumeration, I was thinking if there is any quick method to silent this warning, yet catch any others? I created a "before" hook, but ran into an issue: I get an error "ERR_CONTENT_LENGTH_MISMATCH 200" from the change-email function when using it. Basically the hook just checks the db, and then gives the same response that the successful operation would give. (status: true). I bet someone has taggled this one?
before: createAuthMiddleware(async (ctx) => {
if (ctx.path === '/change-email') {
const newEmail = ctx.body.newEmail.toLowerCase();
const existingUser = await prisma.user.findUnique({
where: { email: newEmail },
select: { id: true },
});
if (existingUser) {
console.log();
// TODO Send "Account already exists" email here
// void sendEmailAlreadyInUse(...)
return ctx.json({ status: true });
}
}
