admin/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2026-02-06 17:13:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

[PM-30563] Change error response on Send Access token request (#6911)

Browse Source 
* feat: remove invalid email response and instead return email and OTP required to protect against enumeration attacks.

* fix: fixing tests and dotnet format
This commit is contained in:
Ike
2026-02-04 09:42:32 -05:00
committed by GitHub
parent 52955d1860
commit 5afdfa6fd1
8 changed files with 27 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/Identity.IntegrationTest/RequestValidation/SendAccess/SendEmailOtpReqestValidatorIntegrationTests.cs
View File

@@ -85,7 +85,7 @@ public class SendEmailOtpRequestValidatorIntegrationTests(IdentityApplicationFac
// Assert
var content = await response.Content.ReadAsStringAsync();
Assert.Contains(OidcConstants.TokenErrors.InvalidRequest, content);
Assert.Contains("email otp sent", content);
Assert.Contains("email and otp are required", content);
}
[Fact]

6
test/Identity.IntegrationTest/RequestValidation/SendAccess/SendNeverAuthenticateRequestValidatorTest.cs
View File

@@ -63,7 +63,7 @@ public class SendNeverAuthenticateRequestValidatorIntegrationTests(
}
[Fact]
public async Task SendAccess_NeverAuthenticateSend_WithEmail_ReturnsEmailInvalid()
public async Task SendAccess_NeverAuthenticateSend_WithEmail_ReturnsEmailAndOtpRequired()
{
// Arrange
var email = "test@example.com";
@@ -77,10 +77,10 @@ public class SendNeverAuthenticateRequestValidatorIntegrationTests(
var content = await response.Content.ReadAsStringAsync();
// should be invalid grant
Assert.Contains(OidcConstants.TokenErrors.InvalidGrant, content);
Assert.Contains(OidcConstants.TokenErrors.InvalidRequest, content);
// Try to compel the invalid email error
var expectedError = SendAccessConstants.EmailOtpValidatorResults.EmailInvalid;
var expectedError = SendAccessConstants.EmailOtpValidatorResults.EmailAndOtpRequired;
Assert.Contains(expectedError, content);
}