⚙️ Enable allauth enumeration prevention - #3096
Open
jefftriplett wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enables django-allauth’s enumeration-prevention behavior by turning on ACCOUNT_PREVENT_ENUMERATION, aiming to reduce account-disclosure via signup and password reset flows.
Changes:
- Set
ACCOUNT_PREVENT_ENUMERATION = Truein base settings. - Updated signup-related tests to assert that “email already registered” is no longer disclosed.
- Added a password reset test to ensure unknown emails do not produce a distinguishable response.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
pydotorg/settings/base.py |
Enables allauth enumeration prevention globally via settings. |
apps/users/tests/test_views.py |
Updates signup duplication assertions and adds a password reset non-enumeration test. |
apps/users/tests/test_forms.py |
Adjusts duplicate-email signup form expectations to avoid revealing a taken email. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+243
to
+244
| # A taken username still has to be reported. A taken email must not be: | ||
| # enumeration prevention sends mail to the address instead. |
Comment on lines
+247
to
+248
|
|
||
| def test_password_reset_does_not_reveal_whether_the_email_is_known(self): |
jefftriplett
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3043.
Flips
ACCOUNT_PREVENT_ENUMERATIONto True, which is also the allauth default.ACCOUNT_EMAIL_VERIFICATIONis already "mandatory", the precondition allauth needs — signing up with an existing address now sends mail instead of showing an error.This closes the email vector, not the username one. Signup still has to reject a taken username, and
UserDetailserves public profiles at /users//, so usernames stay confirmable. #2680 is the other half.Two existing tests asserted the disclosure this removes, so they now assert its absence. Added a password reset test.