Zakaria/FlociClone
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(cognito): honour PreventUserExistenceErrors=ENABLED on app clients #9

Merged
Zakaria merged 1 commits from fix/cognito-prevent-user-existence-errors into main 2026-10-25 12:27:49 +00:00
Conversation 0 Commits 1 Files Changed 3
+99 -7
Zakaria commented 2026-10-25 12:27:44 +00:00
Owner
Copy Link
Copy Source

The setting was stored but never applied, so an unknown username always got
UserNotFoundException and revealed which accounts exist. With ENABLED, answer
as real Cognito does: password sign-in fails with NotAuthorizedException
"Incorrect username or password", ForgotPassword and ResendConfirmationCode
report a simulated delivery, and ConfirmForgotPassword and ConfirmSignUp fail
with CodeMismatchException. LEGACY and unset keep UserNotFoundException.
SRP and USER_AUTH flows are unchanged.

The setting was stored but never applied, so an unknown username always got UserNotFoundException and revealed which accounts exist. With ENABLED, answer as real Cognito does: password sign-in fails with NotAuthorizedException "Incorrect username or password", ForgotPassword and ResendConfirmationCode report a simulated delivery, and ConfirmForgotPassword and ConfirmSignUp fail with CodeMismatchException. LEGACY and unset keep UserNotFoundException. SRP and USER_AUTH flows are unchanged.
Zakaria added 1 commit 2026-10-25 12:27:45 +00:00
fix(cognito): honour PreventUserExistenceErrors=ENABLED on app clients d9a1a36dc8 
The setting was stored but never applied, so an unknown username always got
UserNotFoundException and revealed which accounts exist. With ENABLED, answer
as real Cognito does: password sign-in fails with NotAuthorizedException
"Incorrect username or password", ForgotPassword and ResendConfirmationCode
report a simulated delivery, and ConfirmForgotPassword and ConfirmSignUp fail
with CodeMismatchException. LEGACY and unset keep UserNotFoundException.
SRP and USER_AUTH flows are unchanged.
Zakaria merged commit 957579c8b7 into main 2026-10-25 12:27:49 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Zakaria (authentik Default Admin)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Zakaria/FlociClone#9
Delete Branch "fix/cognito-prevent-user-existence-errors"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?