github-mirrors/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-05-18 03:10:24 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): collapse OAuth callback messages to prevent email-existence oracle

Browse Source 
Two distinct error messages in the OAuth callback endpoint revealed
whether an email address was already registered in the database.
An attacker controlling the OAuth provider's email claim could probe
the user table without authentication. Both cases now return the same
generic message.
This commit is contained in:
timonrieger
2026-04-29 22:53:27 +02:00
parent 8011adadb6
commit fa6ce8cc00
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/src/specs/server/api/oauth.e2e-spec.ts
+1 -1
View File
@@ -351,7 +351,7 @@ describe(`/oauth`, () => {
const callbackParams = await loginWithOAuth('oauth-no-auto-register');
const { status, body } = await request(app).post('/oauth/callback').send(callbackParams);
expect(status).toBe(400);
expect(body).toEqual(errorDto.badRequest('User does not exist and auto registering is disabled.'));
expect(body).toEqual(errorDto.badRequest('OAuth authentication failed'));
});
it('should link to an existing user by email', async () => {