Developers are dogmatic on having "invalid username or password" on login screens; our applications should not reveal if somebody is a member given an email address.
But there are two other ways our application can reveal a member:
- the signup page returns a "this email was registered by somebody else" (often this is a dedicated endpoint for Ajax)
- the reset password page has a "your link has been sent to your email" or "provided email does not exist in our records"
Why are we only worried about the login screen revealing membership? Should we plug these holes as well?
The "provided email does not exist in our records" on reset password page is useful when we have entered a wrong email or we signed up with wrong email address. Example: I am named Raj, have wrongly signed up with email@example.com (mispelled J) and I try to send a reset request to firstname.lastname@example.org.