Prevent user enumeration attack (nextjs#18)

dikaio · Sep 17, 2024 · 8228252 · 8228252
2 parents b80ca03 + ac247b4
commit 8228252
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/app/(login)/actions.ts b/app/(login)/actions.ts
@@ -64,7 +64,7 @@ export const signIn = validatedAction(signInSchema, async (data, formData) => {
     .limit(1);
 
   if (userWithTeam.length === 0) {
-    return { error: 'User not found. Please try again.' };
+    return { error: 'Invalid email or password. Please try again.' };
   }
 
   const { user: foundUser, team: foundTeam } = userWithTeam[0];
@@ -75,7 +75,7 @@ export const signIn = validatedAction(signInSchema, async (data, formData) => {
   );
 
   if (!isPasswordValid) {
-    return { error: 'Incorrect password. Please try again.' };
+    return { error: 'Invalid email or password. Please try again.' };
   }
 
   await Promise.all([
@@ -108,7 +108,7 @@ export const signUp = validatedAction(signUpSchema, async (data, formData) => {
     .limit(1);
 
   if (existingUser.length > 0) {
-    return { error: 'User already exists.' };
+    return { error: 'Failed to create user. Please try again.' };
   }
 
   const passwordHash = await hashPassword(password);