Auth.change_password

[dpilla]

Hey there,
I am having some trouble with the API, auth.change_password. This particular one is taking any un-registered email-id as an argument, the response that I get is the same for both registered and unregistered email ID. I just want to throw an error if the email ID is unregistered can someone help me out with this.

[prashantT]

Please see the explanation for this in this older post:

Why does the Change Password API always return a "valid" result?

The Change Password endpoint will return a success message, regardless of outcome, as a security measure to prevent user enumeration. E.g. a malicious user could use this endpoint to find out whether an email address was registered with your application. The following document explains user enumeration in more detail: https://www.owasp.org/index.php/Testing_for_User_Enumeration_and_Guessable_User_Account_(OWASP-AT-002)