Account Enumeration

// Node.js/Express - Secure against account enumeration

const rateLimit = require('express-rate-limit');

// SECURE: Dummy hash for timing normalization
const DUMMY_HASH = '$2b$10$abcdefghijklmnopqrstuv.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX';

// SECURE: Rate limiting on auth endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 5,  // 5 attempts
  message: 'Too many requests, please try again later',
  standardHeaders: true,
  legacyHeaders: false
});

// SECURE: Login with neutral response
app.post('/login', authLimiter, async (req, res) => {
  const { email, password } = req.body;
  
  const user = await User.findOne({ email });
  
  // SECURE: Always do password comparison to normalize timing
  // Use dummy hash if user doesn't exist
  const hash = user ? user.passwordHash : DUMMY_HASH;
  const passwordMatch = await bcrypt.compare(password, hash);
  
  // SECURE: Same error message for both cases
  if (!user || !passwordMatch) {
    // Log failed attempt for monitoring
    logger.warn('Failed login attempt', { email, ip: req.ip });
    
    return res.status(401).json({ 
      error: 'Invalid email or password' 
    });
  }
  
  req.session.userId = user.id;
  res.json({ success: true });
});

// SECURE: Signup without revealing existence
app.post('/signup', authLimiter, async (req, res) => {
  const { email, password } = req.body;
  
  const existing = await User.findOne({ email });
  
  if (existing) {
    // SECURE: Generic message, doesn't confirm email exists
    // Optionally send email to existing user informing them of attempt
    await sendSecurityAlert(email, 'signup_attempt');
    
    // Still return success to prevent enumeration
    return res.json({ 
      message: 'Please check your email to verify your account' 
    });
  }
  
  const user = await User.create({ 
    email, 
    passwordHash: await bcrypt.hash(password, 12),
    verified: false
  });
  
  await sendVerificationEmail(user);
  
  res.json({ 
    message: 'Please check your email to verify your account' 
  });
});

// SECURE: Remove public check endpoint entirely
// Or require authentication if needed
app.get('/api/check-email', requireAuth, async (req, res) => {
  // Only available to authenticated users checking their own email
  if (req.query.email !== req.user.email) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  const exists = await User.exists({ email: req.query.email });
  res.json({ available: !exists });
});

// SECURE: Password reset with neutral response
app.post('/password-reset', authLimiter, async (req, res) => {
  const { email } = req.body;
  
  const user = await User.findOne({ email });
  
  // SECURE: Always return same message
  // If user exists, send reset email
  // If not, do nothing (but don't reveal this)
  if (user) {
    await sendPasswordResetEmail(user);
    logger.info('Password reset requested', { userId: user.id });
  } else {
    logger.warn('Password reset for non-existent user', { email, ip: req.ip });
  }
  
  // Same response regardless
  res.json({ 
    message: 'If an account exists with that email, a password reset link has been sent' 
  });
});

// SECURE: Profile endpoint returns 200 with null data
app.get('/users/:email', async (req, res) => {
  const { email } = req.params;
  
  const user = await User.findOne({ email }, 'email name bio');
  
  // SECURE: Always 200, return null if not found
  res.status(200).json({
    user: user || null
  });
  // Doesn't reveal existence via status code
});

// SECURE: Invite with neutral response
app.post('/invite', requireAuth, authLimiter, async (req, res) => {
  const { email } = req.body;
  
  const existing = await TeamMember.findOne({ email });
  
  if (existing) {
    // Don't reveal membership
    // Optionally notify existing member of invite attempt
    await notifyMember(existing, 'reinvite_attempted');
  } else {
    await sendInvite(email, req.user.organizationId);
  }
  
  // SECURE: Same response either way
  res.json({ 
    message: 'Invitation will be sent if the user is not already a member' 
  });
});

// SECURE: Monitoring middleware for enumeration attempts
const enumerationDetector = (req, res, next) => {
  // Track failed login attempts by IP
  const key = `attempts:${req.ip}`;
  const attempts = cache.get(key) || 0;
  
  if (attempts > 20) {
    logger.error('Possible enumeration attack', { 
      ip: req.ip, 
      attempts,
      path: req.path 
    });
    
    // Block or challenge with CAPTCHA
    return res.status(429).json({ 
      error: 'Too many requests. Please complete CAPTCHA to continue' 
    });
  }
  
  cache.set(key, attempts + 1, 3600);  // 1 hour TTL
  next();
};

app.use('/login', enumerationDetector);
app.use('/signup', enumerationDetector);
app.use('/password-reset', enumerationDetector);