ohadr / authentication-flows-js Goto Github PK

use policyRepo.getDefaultAuthenticationPolicy().getMaxPasswordEntryAttempts(), rather hard-coded '5'

ensure that Even if we don’t find an email address, we return 'ok' as our status.
We don’t want untoward bots figuring out what emails are real vs not real in our database.

rather than "debug()", use a good logger (e.g. log4js)

change activate URL to /aa/ instead of /aa?uts=

according to https://stackoverflow.com/questions/67290297/how-to-prevent-attackers-from-using-my-password-reset-mechanism-to-email-bomb-pe

My web app has a pretty standard feature that allows a user who forgot their password to reset it by sending themselves a password reset email with a link to the page to create a new password.

I'm concerned that person1 could use this page to harass person2 by claiming to need a password reset email, but giving the email address of person2, and automate this with a bot, sending massive numbers of emails to person2. It wouldn't reveal any secrets, but it could be very annoying, even a DoS on their inbox, and my application would get the blame.

better use use log4js-api, and let the user-app to configure the logger:
https://github.com/log4js-node/log4js-api