1
99%
master: 99%

Ran 19 Apr 2015 05:06AM UTC

Files 114

Run time 4s

Badge

Embed ▾

Committed 19 Apr 2015 05:01AM UTC coverage: 99.516% (+0.02%) from 99.499%

Job # 2.2.1

Build Type

Pull #320

travis-ci

Committed by

monfresh

Commit Message

Prevent discovery of existing email addresses

Devise allows user enumeration by default, but they provide a `paranoid` setting to prevent enumeration when resetting a password or resending confirmation instructions. This PR turns the `paranoid` setting on.

In addition, this PR also makes sure that enumeration is not possible during sign up. Devise does not provide a way to prevent user enumeration for the `registerable` module, so I wrote my own by overriding the `create` method in the Devise registrations controller.

So now, when you try to sign up with an existing email address, instead of getting an error message that says the email has already been taken, you get the same success notice as you would during a regular successful sign up, and an email is sent to the user letting them know that a request was made to sign up with their email address, and provides the user with helpful links and text depending on whether or not they initiated that request.

Pull Request Pull Request #320: Prevent discovery of existing email addresses

Run Details

1645 of 1653 relevant lines covered (99.52%)

68.21 hits per line

codeforamerica / ohana-api / 950 / 1
99%
master: 99%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 950.1 (2.2.1)

codeforamerica / ohana-api / 950 / 1 99% master: 99%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 950.1 (2.2.1)

codeforamerica / ohana-api / 950 / 1
99%
master: 99%

README BADGES
x