You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@syncope.apache.org by "Massimiliano Perrone (Jira)" <ji...@apache.org> on 2026/06/16 13:19:00 UTC

[jira] [Updated] (SYNCOPE-1975) Throttle password reset requests

     [ https://issues.apache.org/jira/browse/SYNCOPE-1975?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Massimiliano Perrone updated SYNCOPE-1975:
------------------------------------------
    Fix Version/s:     (was: 4.0.7)

>   Throttle password reset requests
> ----------------------------------
>
>                 Key: SYNCOPE-1975
>                 URL: https://issues.apache.org/jira/browse/SYNCOPE-1975
>             Project: Syncope
>          Issue Type: Improvement
>            Reporter: Massimiliano Perrone
>            Assignee: Massimiliano Perrone
>            Priority: Major
>             Fix For: 4.1.2, 5.0.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> Password reset requests are currently not rate limited. This can allow repeated requests against the password reset endpoint, including rapid attempts against the security answer flow.
> Introduce configurable throttling for password reset requests before user lookup, so requests for existing and non-existing  usernames are handled consistently.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)