3

When someone goes onto the forgotten password page and enters an email address once they click submit it reloads the log in page even if the email address doesn't exist on the database. Is there a way to get magento to check the database and if the password doesn't exist throw up an error message, and if the password does exist throw a success message?

I cant believe this isn't in magento as standard or is it and im just missing it?

Thanks

Improve this question
1
  • 2
    One possible problem with this is that anybody can "guess" the email addresses by constantly bruteforcing your forgot password page.
    – Aspiration Hosting
    Commented Jan 9, 2015 at 7:08

1 Answer 1

Reset to default
3

TL;DR

It is actually a good thing that it is implemented that way and protects you from various further problems.

Long version:

Implementing such a feature would make your shop more vulnerable for information gathering.

Imagine the following attack vector:

  1. Get a (very long) list of e-mail addresses
  2. Check which e-mail addresses exist in your shop by using the output of the page (success/error)
  3. Use all successful (thus: registered) e-mail addresses and start brute forcing the passwords

Not only will this give a possible attacker the information which e-mail addresses are registered, it will enable him to guess passwords by using brute force.

If your shop does not provide this information in the frontend, it will be much harder to find a correct combination of e-mail address and password as you cannot rely on success/error information provided by the shop.

This might harm your shop in an additional way as brute force attacks may result in denial of service (DoS) due to the possible high load in your shop.

Improve this answer
2
  • Wouldn't they be able to do the same thing using the "sign up" form? Because the sign up form tells you "this email is already in use". Is using Captcha a potential solution? If so, how about using Captcha in forgot password form as well? So that, we can then show "email doesn't exist" message in forgot password page.
    – Mukesh Chapagain
    Commented May 5, 2016 at 14:54
  • True, that is an issue there as well (as you can retrieve information from the error message). Captcha (depending on the implementation) can be a solution against automatic form submission by bots.
    – Anna Völkl
    Commented May 10, 2016 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.