From 4124da14e976e77b6c1e450b8f17b3321b333830 Mon Sep 17 00:00:00 2001 From: anshul23102 Date: Tue, 2 Jun 2026 22:50:07 +0530 Subject: [PATCH] fix(auth): remove email enumeration leak from signup duplicate check Fixes #280 When a signup attempt used an already-registered email, the endpoint returned res.json({ email: existing.email }) with HTTP 200. This echoed the verified email back in the response body, allowing any caller to enumerate which addresses are registered by attempting signup and checking whether the response includes an email field. Changed to res.status(409).json({ error: 'An account with this email already exists' }). HTTP 409 Conflict is the correct status for a resource creation attempt that fails due to a uniqueness constraint. The response body no longer includes any data derived from the existing user document. --- backend/controllers/auth.controller.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/controllers/auth.controller.js b/backend/controllers/auth.controller.js index 7dd531f..94b630f 100644 --- a/backend/controllers/auth.controller.js +++ b/backend/controllers/auth.controller.js @@ -87,7 +87,7 @@ async function signup(req, res, next) { //check for existing email const existing = await User.findOne({ email }); if (existing) { - return res.json({ email: existing.email }); + return res.status(409).json({ error: 'An account with this email already exists' }); } const hashed = await bycrypt.hash(password, 10); let user;