UserValidator.ValidateUserName - FindByName check could be bypassed if username has not changed
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is your feature request related to a problem? Please describe.
Not really, trying to optimise "database" access for common scenarios, especially non SQL backends
### Describe the solution you'd like
When UserManager.UpdateAsync(user) is invoked, the UserValidator<T>.ValidateAsync is invoked. This eventually calls UserStore.FindByName to validate the username is unique in the system and matches the current user if found.
If the username hasn't changed ( rerun manager.NormalizeName and check against user.NormalizedUserName? ) then why check if the username is unique... that has already been checked on creation.
### Additional context
Same for ValidateEmail
Contributor guide
Assessment
This issue has not been assessed yet.