Skip to content

Reject existing-user claims in FastAPI signup flow#204

Open
PrivateBasicsApp wants to merge 1 commit intoetesync:masterfrom
PrivateBasicsApp:master
Open

Reject existing-user claims in FastAPI signup flow#204
PrivateBasicsApp wants to merge 1 commit intoetesync:masterfrom
PrivateBasicsApp:master

Conversation

@PrivateBasicsApp
Copy link
Copy Markdown

Prevent unauthenticated account takeover where /signup/ could initialize UserInfo for a pre-provisioned user and immediately return a valid auth token.

Details:

  • Preserve existing new-user creation logic and UserInfo initialization for truly new accounts.
  • In signup_save (etebase_server/fastapi/routers/authentication.py) check for an existing username via get_user_queryset(...).get(...) and immediately raise HttpError("user_exists", ...) (HTTP 409) if found.
  • Remove the previous behavior that only rejected the request when instance already had a userinfo, so the endpoint is now strictly for new-user creation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant