950
99%

Ran 19 Apr 2015 05:06AM UTC

Jobs 1

Files 114

Run time 5s

Badge

Embed ▾

pending completion

Build # 950

Build Type

Pull #320

travis-ci

Committed by

monfresh

Commit Message

Prevent discovery of existing email addresses

Devise allows user enumeration by default, but they provide a `paranoid` setting to prevent enumeration when resetting a password or resending confirmation instructions. This PR turns the `paranoid` setting on.

In addition, this PR also makes sure that enumeration is not possible during sign up. Devise does not provide a way to prevent user enumeration for the `registerable` module, so I wrote my own by overriding the `create` method in the Devise registrations controller.

So now, when you try to sign up with an existing email address, instead of getting an error message that says the email has already been taken, you get the same success notice as you would during a regular successful sign up, and an email is sent to the user letting them know that a request was made to sign up with their email address, and provides the user with helpful links and text depending on whether or not they initiated that request.

Pull Request Pull Request #320: Prevent discovery of existing email addresses

Run Details

1645 of 1653 relevant lines covered (99.52%)

68.21 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	950.1 (2.2.1)	19 Apr 2015 05:06AM UTC	0	99.52	Travis Job 950.1

codeforamerica / ohana-api / 950
99%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 950

codeforamerica / ohana-api / 950 99%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 950

codeforamerica / ohana-api / 950
99%

README BADGES
x