Immediate Feedback on the Identifier Screen for Non-Existent Emails in Auth0
Last Updated:
Overview
Auth0 does not support providing immediate feedback for non-existent email addresses on the identifier screen during an identifier-first flow. Providing this feedback introduces a security vulnerability for user enumeration attacks by allowing bad actors to differentiate between existing and non-existent accounts.
Applies To
- Auth0
- Identifier-First Flow
- Login Page
Solution
Does Auth0 provide immediate feedback for non-existent emails on the identifier screen?
Auth0 does not support providing feedback on non-existent email addresses to users on the identifier screen page due to the following security vulnerabilities.
- Providing this feedback introduces a security vulnerability for user enumeration attacks.
- If bad actors can distinguish between an account that exists and one that does not, they can easily narrow down which users exist within an organization.
Review the Open Worldwide Application Security Project (OWASP) specifications for more information on user enumeration.
