plataformatec/devise — Issue #1410: Logging in checks for confirmation before validating credentials
Author: anulman
Created: 2011-11-01 20:15:38+00:00
State: open

I'm fairly green, so please forgive any mistakes I might make in reporting this issue. (Please correct me, as I'm willing to learn!)

When trying to log in with an existing email address/account identifier, but the wrong password, for an account that has not yet been confirmed, Devise seems to check for confirmation before the login/password combo. This leads to an error pointing people to confirm their accounts, not an error that the credentials are incorrect.

This, in the best case, is a bit of a privacy issue; in the worst case, it allows attackers to find out whether or not an email/login name has been used.

I'm going to fork the repo and try to switch this order, but I'm not sure if I'll succeed. So I'm flagging it for everyone's attention.