[PR #4179] [MERGED] Return generic auth error to prevent user enumeration attacks #3831

New issue

Closed

opened 2026-02-26 08:32:07 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 08:32:07 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4179
Author: @tametsi
Created: 11/22/2024
Status: ✅ Merged
Merged: 11/23/2024
Merged by: @jc21

Base: develop ← Head: develop

📝 Commits (1)

640a1ee Return generic auth error to prevent user enumeration attacks

📊 Changes

1 file changed (+5 additions, -3 deletions)

View changed files

📝 backend/internal/token.js (+5 -3)

📄 Description

When authentication fails, the generic error message "Invalid email or password" is returned. Thereby, no information about the existence of the user is given.

This prevents user enumeration attacks because the response for both scenarios is identical.

Fixes #3873

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4179 **Author:** [@tametsi](https://github.com/tametsi) **Created:** 11/22/2024 **Status:** ✅ Merged **Merged:** 11/23/2024 **Merged by:** [@jc21](https://github.com/jc21) **Base:** `develop` ← **Head:** `develop` --- ### 📝 Commits (1) - [`640a1ee`](https://github.com/NginxProxyManager/nginx-proxy-manager/commit/640a1eeb68053bafed9a80525d339642de90e0d3) Return generic auth error to prevent user enumeration attacks ### 📊 Changes **1 file changed** (+5 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/token.js` (+5 -3) </details> ### 📄 Description When authentication fails, the generic error message "Invalid email or password" is returned. Thereby, no information about the existence of the user is given. This prevents user enumeration attacks because the response for both scenarios is identical. Fixes #3873 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 08:32:07 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#3831

No description provided.

Rows
Columns