No error messages for passwordless/email login for non-existing user

lihua.zhang · August 25, 2023, 9:47pm

Problem statement

We use the New Universal Login, have set up passwordless login using email, and have disabled the “sign-up” option.

I noticed that if I enter an incorrect email address, meaning one that we do not have a user for, then it still asks for a code without an error message on the login widget saying that the user doesn’t exist.

Is that intended and recommended, or is there a way to configure a message such as “Invalid user”?

Solution

Unfortunately, this is the default behavior in New Universal Login that cannot be changed. The Classic Universal Login acts differently, and you can customize the error message. Although, the error message is a fallback that covers any errors apart from the ones in the list you see here:

github.com

auth0/lock/blob/master/src/i18n/en.js#L39


      
            too_many_attempts: 'Your account has been blocked after multiple consecutive login attempts.',
            too_many_requests:
              "We're sorry. There are too many requests right now. Please reload the page and try again. If this persists, please try again later.",
            session_missing:
              "Couldn't complete your authentication request. Please try again after closing all open dialogs",
            'hrd.not_matching_email': 'Please use your corporate email to login.'
          },
          passwordless: {
            'bad.email': 'The email is invalid',
            'bad.phone_number': 'The phone number is invalid',
            'lock.fallback': "We're sorry, something went wrong",
            invalid_captcha: 'Solve the challenge question to verify you are not a robot.',
            invalid_recaptcha: 'Select the checkbox to verify you are not a robot.'
          },
          signUp: {
            invalid_password: 'Password is invalid.',
            'lock.fallback': "We're sorry, something went wrong when attempting to sign up.",
            password_dictionary_error: 'Password is too common.',
            password_leaked: 'This combination of credentials was detected in a public data breach on another website. Before your account is created, please use a different password to keep it secure.',
            password_no_user_info_error: 'Password is based on user information.',
            password_strength_error: 'Password is too weak.',

In the New Universal Login, this was done on purpose to prevent enumeration attacks. However, feel free to log a feature request here: