{"action":"closed","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/4972","repository_url":"https://api.github.com/repos/plataformatec/devise","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/4972/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/4972/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/4972/events","html_url":"https://github.com/plataformatec/devise/issues/4972","id":381517328,"node_id":"MDU6SXNzdWUzODE1MTczMjg=","number":4972,"title":"Security issue with translations at login","user":{"login":"gloaec","id":902567,"node_id":"MDQ6VXNlcjkwMjU2Nw==","avatar_url":"https://avatars2.githubusercontent.com/u/902567?v=4","gravatar_id":"","url":"https://api.github.com/users/gloaec","html_url":"https://github.com/gloaec","followers_url":"https://api.github.com/users/gloaec/followers","following_url":"https://api.github.com/users/gloaec/following{/other_user}","gists_url":"https://api.github.com/users/gloaec/gists{/gist_id}","starred_url":"https://api.github.com/users/gloaec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gloaec/subscriptions","organizations_url":"https://api.github.com/users/gloaec/orgs","repos_url":"https://api.github.com/users/gloaec/repos","events_url":"https://api.github.com/users/gloaec/events{/privacy}","received_events_url":"https://api.github.com/users/gloaec/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-11-16T09:32:50Z","updated_at":"2018-11-16T21:49:43Z","closed_at":"2018-11-16T21:49:43Z","author_association":"NONE","body":"## Environment\r\n\r\n- Ruby **2.3.1**\r\n- Rails **5.2.1**\r\n- Devise **4.5.0**\r\n\r\n## Current behavior\r\n\r\nJust noticed that there is 2 similar error messages thrown on failed login attempt :\r\n\r\n- `devise.failure.invalid: \"Invalid %{authentication_keys} or password.\"`\r\n- `devise.failure.not_found_in_database: \"Invalid %{authentication_keys} or password.\"`\r\n\r\nBut in french for instance, the two messages are different : \r\n\r\n- `devise.failure.invalid: \"Email ou mot de passe incorrect.\"`\r\n- `devise.failure.not_found_in_database: \"Email ou mot de passe invalide.\"`\r\n\r\nI also noticed that the error that is thrown on failed login depends on the field that is wrong :\r\n\r\n    user = users(:valid)\r\n    user.skip_confirmation!\r\n    user.save!\r\n\r\n    post api_sign_in_url, params: {\r\n      user: {\r\n        login: \"good_login\",\r\n        password: \"wrong_password\",\r\n      }\r\n    }\r\n    assert_response :unauthorized\r\n    assert_equal json_response['error'], I18n.t(:\"devise.failure.invalid\")\r\n\r\n    post api_sign_in_url, params: {\r\n      user: {\r\n        login: \"wrong_login\",\r\n        password: \"good_password\",\r\n      }\r\n    }\r\n    assert_response :unauthorized\r\n    assert_equal json_response['error'], I18n.t(:\"devise.failure.not_found_in_database\")\r\n\r\nThis behavior, depending on the language that is used, gives the user the possibility to guess part of the credentials that exist in the database. Therefore, I think this might be a security issue.\r\n\r\n## Expected behavior\r\n\r\nThe message thrown on failed login attempt should be the same, regardless of the information that is correct in the login form. The message `not_found_in_database` should not exist.\r\n"}}
{"actor":{"display_login":"rafaelfranca"}}