4d362da9f0
## Description The current password reset endpoint returns different HTTP status codes and messages depending on whether the email exists in the system (200 for existing emails, 404 for non-existing ones). This allows attackers to enumerate valid email addresses via the password reset form. ## Changes ### `app/controllers/devise_overrides/passwords_controller.rb` - Removed the `if/else` branch that returned different responses based on email existence - Now always returns a generic `200 OK` response with the same message regardless of whether the email exists - Uses safe navigation operator (`&.`) to send reset instructions only if the user exists ### `config/locales/en.yml` - Consolidated `reset_password_success` and `reset_password_failure` into a single generic `reset_password` key - New message does not reveal whether the email exists in the system ## Security Impact - **Before**: An attacker could determine if an email was registered by observing the HTTP status code (200 vs 404) and response message - **After**: All requests receive the same 200 response with a generic message, preventing user enumeration This follows [OWASP guidelines for authentication error messages](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-responses). Fixes #13527
45 lines
1.6 KiB
Ruby
45 lines
1.6 KiB
Ruby
class DeviseOverrides::PasswordsController < Devise::PasswordsController
|
|
include AuthHelper
|
|
|
|
skip_before_action :require_no_authentication, raise: false
|
|
skip_before_action :authenticate_user!, raise: false
|
|
|
|
def create
|
|
@user = User.from_email(params[:email])
|
|
@user&.send_reset_password_instructions
|
|
build_response(I18n.t('messages.reset_password'), 200)
|
|
end
|
|
|
|
def update
|
|
# params: reset_password_token, password, password_confirmation
|
|
original_token = params[:reset_password_token]
|
|
reset_password_token = Devise.token_generator.digest(self, :reset_password_token, original_token)
|
|
@recoverable = User.find_by(reset_password_token: reset_password_token)
|
|
if @recoverable && reset_password_and_confirmation(@recoverable)
|
|
send_auth_headers(@recoverable)
|
|
render partial: 'devise/auth', formats: [:json], locals: { resource: @recoverable }
|
|
else
|
|
render json: { message: 'Invalid token', redirect_url: '/' }, status: :unprocessable_entity
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def reset_password_and_confirmation(recoverable)
|
|
recoverable.confirm unless recoverable.confirmed? # confirm if user resets password without confirming anytime before
|
|
recoverable.reset_password(params[:password], params[:password_confirmation])
|
|
recoverable.reset_password_token = nil
|
|
recoverable.confirmation_token = nil
|
|
recoverable.reset_password_sent_at = nil
|
|
recoverable.save!
|
|
end
|
|
|
|
def build_response(message, status)
|
|
render json: {
|
|
message: message
|
|
}, status: status
|
|
end
|
|
end
|
|
|
|
DeviseOverrides::PasswordsController.prepend_mod_with('DeviseOverrides::PasswordsController')
|