You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Should username form trigger an INVALID_USERNAME error?
#14835
In a Keycloak based project, we have implemented a two step login flow, using the username form and the password form provided with Keycloak. Unrelated to this discussion but the reason for this is we have implemented a custom idp redirector to redirect to the relevant idp based on the username (or default to password).
We have noticed that the username form returns an error ("Invalid username or email.") if there is no username linked to a user known by Keycloak, and we are worried about the potential for hackers to use this for username enumeration.
We know we can easily create our own version of the username form without this error, but would like to get the Keycloak community view on this.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hi everyone,
In a Keycloak based project, we have implemented a two step login flow, using the username form and the password form provided with Keycloak. Unrelated to this discussion but the reason for this is we have implemented a custom idp redirector to redirect to the relevant idp based on the username (or default to password).
We have noticed that the username form returns an error ("Invalid username or email.") if there is no username linked to a user known by Keycloak, and we are worried about the potential for hackers to use this for username enumeration.
We know we can easily create our own version of the username form without this error, but would like to get the Keycloak community view on this.
Thanks for your insight!
All reactions