Prevent Account enumeration in passwordless email login (method: code)

[Tan-Aki]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

(Might be duplicate of #133)

In the passwordless email login flow (method: code, passwordless_enabled: true), account enumeration is possible.

The response returned by Kratos differs depending on whether the identifier exists in the database. We would like to know whether there is a supported configuration option, similar to security.account_enumeration.mitigate for identifier-first authentication, to mitigate account enumeration for passwordless email login (we have tried enabling this setting and, as expected, it does not affect the passwordless code flow).

Observed behavior

Identifier exists

Request:

{
  "csrf_token": "<token>",
  "identifier": "test@test.com",
  "method": "code"
}

Response:

{
  "messages": [
    {
      "id": 1010014,
      "text": "An email containing a code has been sent to the email address you provided. If you have not received an email, check the spelling of the address and retry the login.",
      "type": "info"
    }
  ]
}

Identifier does not exist

Request:

{
  "csrf_token": "<token>",
  "identifier": "nonexistent@test.com",
  "method": "code"
}

Response:

{
  "messages": [
    {
      "id": 4000035,
      "text": "This account does not exist or has not setup sign in with code.",
      "type": "error"
    }
  ]
}

Describe your ideal solution

Is there a supported or planned configuration setting, comparable to security.account_enumeration.mitigate for identifier-first authentication, that would allow account enumeration mitigation for the passwordless email (code) login flow?

If not, confirmation that this behavior is expected and intentionally unsupported would also be helpful.

Workarounds or alternatives

We have had to disable the Passwordless feature for now.

Version

Kratos self hosted v1.3.1

Additional Context

Environment

Setting	Value
Ory Kratos	v1.3.1
Authentication flow	passwordless email login
Login method	code
passwordless_enabled	true

Relevant configuration

selfservice:
  methods:
    code:
      enabled: true
      passwordless_enabled: true

security:
  account_enumeration:
    mitigate: true

[Tan-Aki]

Additional finding: Account enumeration during code validation

In addition to the enumeration described above during code generation, there is also account enumeration during code validation.

Observed behavior

When a user submits a login code, the error message differs depending on whether the account exists:

Account does not exist

Request:

{
  "code": "123123123",
  "csrf_token": "<token>",
  "identifier": "nonexistent@test.com",
  "method": "code"
}

Response:

{
  "messages": [
    {
      "id": 4000035,
      "text": "This account does not exist or has not setup sign in with code.",
      "type": "error"
    }
  ]
}

Account exists but code is invalid

Request:

{
  "code": "123123123",
  "csrf_token": "<token>",
  "identifier": "existing@test.com",
  "method": "code"
}

Response:

{
  "messages": [
    {
      "id": 4010004,
      "text": "The login code is invalid or has already been used. Please try again.",
      "type": "error"
    }
  ]
}

Attack scenario

An attacker can:

1. Request a login code for any email address
2. Submit a random code
3. Determine if the account exists based on the error message returned

This means even if enumeration mitigation is implemented at the code generation step, an attacker can still enumerate accounts by proceeding to the code validation step.

Expected behavior

Both scenarios should return the same generic "invalid code" error (message ID 4010004) to prevent distinguishing between "account not found" and "wrong code".

[Tan-Aki]

For now we have created the following patch as work around :

# Account Enumeration Mitigation Patch for Ory Kratos
#
# This patch contains two fixes:
#   PATCH 1 (line ~388): Code Generation - Fake success when account doesn't exist
#   PATCH 2 (line ~464): Code Verification - Return generic "invalid code" error
#
diff --git a/selfservice/strategy/code/strategy_login.go b/selfservice/strategy/code/strategy_login.go
--- a/selfservice/strategy/code/strategy_login.go
+++ b/selfservice/strategy/code/strategy_login.go
@@ -388,5 +388,42 @@
 
 	i, addresses, err := s.findIdentityForIdentifier(ctx, p.Identifier, f.RequestedAAL, sess)
 	if err != nil {
+		// =======================================================================
+		// PATCH 1: Code Generation (sending login code)
+		// When user requests a login code for a non-existent account, fake a
+		// success response instead of revealing "account not found"
+		// =======================================================================
+		if codeCred := new(schema.ValidationError); errors.As(err, &codeCred) && len(codeCred.Messages) > 0 && codeCred.Messages[0].ID == text.ErrorValidationNoCodeUser {
+
+			// Change the flow state to "email sent" (same as if we actually sent a code)
+			f.SetState(flow.StateEmailSent)
+
+			// Update the UI to show the "enter your code" input field
+			// Keep the email they typed in a hidden field so we know who they claimed to be
+			if err := s.NewCodeUINodes(r, f, &codeIdentifier{Identifier: p.Identifier}); err != nil {
+				return err
+			}
+
+			// Mark the active authentication method as "code" (passwordless)
+			f.Active = identity.CredentialsTypeCodeAuth
+
+			// Save the updated flow to the database
+			if err = s.deps.LoginFlowPersister().UpdateLoginFlow(ctx, f); err != nil {
+				return err
+			}
+
+			// Return the response to the user
+			if x.IsJSONRequest(r) {
+				// API call: return JSON with the flow object
+				s.deps.Writer().WriteCode(w, r, http.StatusBadRequest, f)
+			} else {
+				// Browser: redirect to the login page (which will show the code input form)
+				http.Redirect(w, r, f.AppendTo(s.deps.Config().SelfServiceFlowLoginUI(ctx)).String(), http.StatusSeeOther)
+			}
+
+			// Tell Kratos "I handled this, stop processing"
+			// (No email was actually sent - the user will be stuck at the code entry screen)
+			return errors.WithStack(flow.ErrCompletedByStrategy)
+		}
 		return err
 	}
@@ -464,4 +501,12 @@
 	}
 	if err != nil {
+		// =======================================================================
+		// PATCH 2: Code Verification (validating login code)
+		// When user enters a code for a non-existent account, return generic
+		// "invalid code" error instead of revealing "account not found"
+		// =======================================================================
+		if codeCred := new(schema.ValidationError); errors.As(err, &codeCred) && len(codeCred.Messages) > 0 && codeCred.Messages[0].ID == text.ErrorValidationNoCodeUser {
+			return nil, schema.NewLoginCodeInvalid()
+		}
 		return nil, err
 	}