Preventing User Enumeration on Registration Page

Preventing User Enumeration on Registration Page

Since the username is the public part, it isn't the end of the world if it can be enumerated, however if you really do want to avoid this, the easiest thing is to have them use e-mail address as the username.

Then you simply say that you sent a link to the e-mail no matter if they have an account already or not.

 

作者:Chuck Lu    GitHub