No error messages for passwordless/email login for non-existing user

lihua.zhang · August 25, 2023, 9:47pm

Problem statement

We use the New Universal Login, have set up passwordless login using email, and have disabled the “sign-up” option.

I noticed that if I enter an incorrect email address, meaning one that we do not have a user for, then it still asks for a code without an error message on the login widget saying that the user doesn’t exist.

Is that intended and recommended, or is there a way to configure a message such as “Invalid user”?

Solution

Unfortunately, this is the default behavior in New Universal Login that cannot be changed. The Classic Universal Login acts differently, and you can customize the error message. Although, the error message is a fallback that covers any errors apart from the ones in the list you see here:

github.com

auth0/lock/blob/master/src/i18n/en.js#L39


      
            too_many_attempts: 'Your account has been blocked after multiple consecutive login attempts.',
            too_many_requests:
              "We're sorry. There are too many requests right now. Please reload the page and try again. If this persists, please try again later.",
            session_missing:
              "Couldn't complete your authentication request. Please try again after closing all open dialogs",
            'hrd.not_matching_email': 'Please use your corporate email to login.'
          },
          passwordless: {
            'bad.email': 'The email is invalid',
            'bad.phone_number': 'The phone number is invalid',
            'lock.fallback': "We're sorry, something went wrong",
            invalid_captcha: 'Solve the challenge question to verify you are not a robot.',
            invalid_recaptcha: 'Select the checkbox to verify you are not a robot.'
          },
          signUp: {
            invalid_password: 'Password is invalid.',
            'lock.fallback': "We're sorry, something went wrong when attempting to sign up.",
            password_dictionary_error: 'Password is too common.',
            password_leaked: 'This combination of credentials was detected in a public data breach on another website. Before your account is created, please use a different password to keep it secure.',
            password_no_user_info_error: 'Password is based on user information.',
            password_strength_error: 'Password is too weak.',

In the New Universal Login, this was done on purpose to prevent enumeration attacks. However, feel free to log a feature request here:

Topic		Replies	Views
Same login behavior for non existing users Help auth0 , login	4	1821	December 21, 2022
SignIn page is not UX perfect Help	2	2284	March 5, 2022
Allow New Universal Login / Passwordless login to show an error message if the provided email is unknown Feedback	1	1148	June 29, 2023
Provide understandable errors in universal sign up / login forms Help error , new-universal-login	8	4169	July 18, 2022
Cannot utilize error messages from actions/hooks in universal login screen Help lock , rules , passwordless , login	2	2993	November 11, 2022

No error messages for passwordless/email login for non-existing user

Problem statement

Solution

Related Topics