Don't allow "system" users to request password resets
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 303
- Forks
- 211
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 5
Description
In chef/oc-id#44 @smith said:
Currently this only means "pivotal." You shouldn't be able to request a password reset for pivotal, since pivotal can't authenticate with a password. Anybody who tries this should get a helpful error message.
@luckymike added:
I'd also suggest setting that users's email to 'nil' or some other plainly unusable value. Seeing that email address is likely to raise sirens for some security teams, even if we "know" that it's not functionally a concern.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating the password-reset handling and the definition of system users, then verify how pivotal is represented and authenticated; done means reset requests are rejected with a helpful error and the system user's email is unusable as requested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100