949
100%
master: 99%

Ran 19 Apr 2015 05:02AM UTC

Jobs 1

Files 114

Run time 5s

Badge

Embed ▾

pending completion

Build # 949

Build Type

push

travis-ci

Committed by

monfresh

Commit Message

Prevent discovery of existing email addresses

Devise allows user enumeration by default, but they provide a `paranoid` setting to prevent enumeration when resetting a password or resending confirmation instructions. This PR turns the `paranoid` setting on.

In addition, this PR also makes sure that enumeration is not possible during sign up. Devise does not provide a way to prevent user enumeration for the `registerable` module, so I wrote my own by overriding the `create` method in the Devise registrations controller.

So now, when you try to sign up with an existing email address, instead of getting an error message that says the email has already been taken, you get the same success notice as you would during a regular successful sign up, and an email is sent to the user letting them know that a request was made to sign up with their email address, and provides the user with helpful links and text depending on whether or not they initiated that request.

Run Details

1645 of 1653 relevant lines covered (99.52%)

68.21 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	949.1 (2.2.1)	19 Apr 2015 05:02AM UTC	0	99.52	Travis Job 949.1

Source Files on build 949

Detailed source file information is not available for this build.

codeforamerica / ohana-api / 949
100%
master: 99%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 949

codeforamerica / ohana-api / 949 100% master: 99%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 949

codeforamerica / ohana-api / 949
100%
master: 99%

README BADGES
x