Custom database: signup returns vague error when user already exists

Help
3

Hi @martinmaillard,

Welcome to the Auth0 Community!

I understand that your users are seeing a vague error whenever they attempt to sign up but already exist in your Custom Database and would like to inform your users that they already have an account.

Before we continue, I’d like to emphasize that the error message is purposefully designed to be vague to not give away any clues that the email address or user already exists. Having an error message that reveals information about the email address or user’s existence would expose the application to user enumeration. More on that detailed in this Community Post.

Now, you can change the sign-up error message and it’s up to your discretion, but I’d recommend being as conservative as possible with the custom error message to avoid any security risks.

To customize the sign-up error message, you’ll need to go to your Universal Login Page and modify the Language Dictionary Object in the Lock Configuration Options.

Something like the following:

var lock = new Auth0Lock(config.clientID, config.auth0Domain, {
    languageDictionary: {
        error:{
            signUp: {
            'lock.fallback': "We're sorry, something went wrong when attempting to sign up.",
            }
        }
    },
    ... 
    // Redacted for brevity

Hoped this helps!

Please let me know if there are any further questions. I’d be happy to help.

Thank you.

1 Like