From 20b83b4a7dd55729ee63e2c229ef39f45cf145f9 Mon Sep 17 00:00:00 2001 From: Danielle Maywood Date: Tue, 29 Oct 2024 11:26:53 +0000 Subject: [PATCH 1/2] chore: log when attempted password resets fail --- coderd/userauth.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/coderd/userauth.go b/coderd/userauth.go index f1a19d77d23d0..723db6e90da35 100644 --- a/coderd/userauth.go +++ b/coderd/userauth.go @@ -291,6 +291,8 @@ func (api *API) postRequestOneTimePasscode(rw http.ResponseWriter, r *http.Reque if err != nil { logger.Error(ctx, "unable to notify user about one-time passcode request", slog.Error(err)) } + } else { + logger.Warn(ctx, "password reset requested for account that does not exist", slog.F("email", req.Email)) } } @@ -381,6 +383,7 @@ func (api *API) postChangePasswordWithOneTimePasscode(rw http.ResponseWriter, r now := dbtime.Now() if !equal || now.After(user.OneTimePasscodeExpiresAt.Time) { + logger.Warn(ctx, "password reset attempted with invalid one-time passcode", slog.F("email", req.Email)) httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ Message: "Incorrect email or one-time passcode.", }) From 0b013a60c0c34b13cbd27da30fa8e0afe1a8a35e Mon Sep 17 00:00:00 2001 From: Danielle Maywood Date: Tue, 29 Oct 2024 12:06:31 +0000 Subject: [PATCH 2/2] chore: update message Co-authored-by: Mathias Fredriksson --- coderd/userauth.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/coderd/userauth.go b/coderd/userauth.go index 723db6e90da35..13f9b088d731f 100644 --- a/coderd/userauth.go +++ b/coderd/userauth.go @@ -383,7 +383,7 @@ func (api *API) postChangePasswordWithOneTimePasscode(rw http.ResponseWriter, r now := dbtime.Now() if !equal || now.After(user.OneTimePasscodeExpiresAt.Time) { - logger.Warn(ctx, "password reset attempted with invalid one-time passcode", slog.F("email", req.Email)) + logger.Warn(ctx, "password reset attempted with invalid or expired one-time passcode", slog.F("email", req.Email)) httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ Message: "Incorrect email or one-time passcode.", }) pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy