Error 'Something Went Wrong' when user tries to register an already registered email address

[sajith.jayaratne]

Hi,

I have come across an issue where if a user registers themselves first and then goes back to the registration page and uses the same email address, it comes up with ‘Something went wrong’.

Shouldn’t it ideally say that this user is already registered? Or am I missing something here?

Thanks
Saj

[rueben.tiow]

Hi @sajith.jayaratne,

Welcome to the Auth0 Community!

The “Something went wrong” error is the expected behavior since revealing that a “user already exists” may allow a malicious actor to infer that the account actually exists and target that specific account knowing that it’s valid. Because of this, we strongly recommend using a generic error for the public signup error message.

Please check out this Community Topic that explains this in more depth:

Invalid_signup error returns instead of user_exists from authentication API

Hello, we recently changed user_exits error to invalid_signup to improve security against a potential username enumeration attack. The feature is “on” by default for new tenants so these would get a generic invalid_signup error. For existing tenants it’s an opt-in behaviour which can be enabled from tenant settings. You can find the official notification here. We highly recommend that you turn on this feature to close username enumeration threat. [image]

Thanks,
Rueben