Skip to main content

Email uniqueness not properly verified

Need​

Ensure email uniqueness verification during registration process

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of System.ComponentModel.DataAnnotations for data validation and annotation in .NET development

Description​

Non compliant code​

public class RegisterModel
{
    [Required]
    [EmailAddress]
    [Display(Name = "Email")]
    public string Email { get; set; }
}

The above code represents the registration process in an ASP.NET Core application. The RegisterModel class is a model that represents the data coming from the registration form. The AccountController is a controller that handles the registration process.

The Register method in the AccountController class takes a RegisterModel as a parameter. If the model state is valid, it creates a new IdentityUser with the email provided and attempts to create the user.

The issue here is that the system allows the plus character in the email registration process. This means an attacker could abuse this feature to create several accounts pointing to the same email. For example, an attacker could use "[email protected]", "[email protected]", and so on, and all these emails will be delivered to "[email protected]". This could be used to bypass email uniqueness validation, as the system treats these as separate emails.

Steps​

  • Implement server-side validation to check for email uniqueness during the registration process.
  • Modify the database schema to enforce email uniqueness at the database level.
  • Update the registration logic to handle the uniqueness constraint violation gracefully and provide appropriate error messages to the user.
  • Consider implementing additional security measures, such as rate limiting or CAPTCHA, to prevent automated abuse of the registration process.

Compliant code​

public class RegisterModel
{
    [Required]
    [EmailAddress]
    [Display(Name = "Email")]
    [Remote(action: "VerifyEmail", controller: "Account")]
    public string Email { get; set; }
}

public class AccountController : Controller
{
    private readonly ApplicationDbContext _context;

    public AccountController(ApplicationDbContext context)
    {
        _context = context;
    }

    public async Task<IActionResult> VerifyEmail(string email)
    {
        if (await _context.Users.AnyAsync(u => u.Email == email))
        {
            return Json($"Email {email} is already in use.");
        }

        return Json(true);
    }
}

The updated code includes a new attribute [Remote(action: "VerifyEmail", controller: "Account")] in the RegisterModel class. This attribute is used to call a remote server-side method to validate the uniqueness of an email address during the registration process.

The VerifyEmail method is added to the AccountController class. This method checks if the provided email address is already in use by any existing user in the database. If the email is already in use, it returns a JSON response with an error message. If the email is not in use, it returns a JSON response with true.

This server-side validation ensures that each email address can only be used to create one account, preventing an attacker from creating multiple accounts with the same email address.

In addition to this, consider modifying the database schema to enforce email uniqueness at the database level. This can be done by adding a unique constraint to the email column in the users table.

Also, consider implementing additional security measures, such as rate limiting or CAPTCHA, to prevent automated abuse of the registration process. These measures can help to further enhance the security of your application.

References​

Last updated on