Redirect a user to login if they already exist about infisical

[Grraahaam]

Just going through the issues and spotted this (sorry if I bring back up an old issue 😬 )

or tell them that this email is already taken.

IMHO to protect users from malicious people/attackers 🕵🏽 , we should never return a message like "Email already taken" since it's an useful information while scraping and brute-forcing.

We could although add a warning after X login attempts to ask the user if he want to reset his password, then if the current email is taken only its owner will know about the request, no one else and we'll keep our users safe ✌🏽

What do you think?

[dangtony98]

@Grraahaam Agreed with this one.

For a security solution like Infisical, it's best that we don't leak that information and just tell them that the login was unsuccessful - leaking it confirms to bad actors that in fact such an account exists.

[vmatsiiako]

Sounds good! Then I will close this one

[miraimech]

hello! i can help

[vmatsiiako]

Hi @sscla1! Thank you so much! That would be awesome! Would you be able to join our community Slack so that we can discuss there? Here is the link: https://join.slack.com/t/infisical-users/shared_invite/zt-1kdbk07ro-RtoyEt_9E~fyzGo_xQYP6g