🎉 Make social auth exceptions configurable #13596
Merged
DryRunSecurity / General Security Analyzer
succeeded
Nov 9, 2025 in 32s
DryRun Security
Details
General Security Analyzer Findings: 1 detected
⚠️ Information Disclosure via Distinct Error Messages dojo/settings/settings.dist.py (click for details)
| Type | Information Disclosure via Distinct Error Messages |
| Description | The system provides distinct error messages for different social authentication failure states. Specifically, the 'AuthForbidden' message ('You are not authorized to log in via this method.') implies that a user account exists but is not permitted to use social login, while the 'AuthFailed' message ('Social login failed.') is more generic. This distinction allows an attacker to enumerate valid user accounts by observing which error message is returned for a given login attempt. |
| Filename | dojo/settings/settings.dist.py |
| CodeLink | django-DefectDojo/dojo/settings/settings.dist.py Lines 180 to 183 in 2c06e6e |
Loading