dotnet / dotnet/aspnetcore

UserValidator.ValidateUserName - FindByName check could be bypassed if username has not changed

Open
#22,815 0 comments 0 reactions 0 assignees View on GitHub
affected-very-few area-identity enhancement severity-nice-to-have
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is your feature request related to a problem? Please describe.
Not really, trying to optimise "database" access for common scenarios, especially non SQL backends

### Describe the solution you'd like
When UserManager.UpdateAsync(user) is invoked, the UserValidator<T>.ValidateAsync is invoked. This eventually calls UserStore.FindByName to validate the username is unique in the system and matches the current user if found.

If the username hasn't changed ( rerun manager.NormalizeName and check against user.NormalizedUserName? ) then why check if the username is unique... that has already been checked on creation.

### Additional context

Same for ValidateEmail

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.