Skip to main content

Email uniqueness not properly verified

Need​

Validation of email uniqueness during registration process

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for building Java web applications with Servlets
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.http.*;
import java.io.IOException;
import javax.servlet.ServletException;

public class RegisterServlet extends HttpServlet {

    private UserRepository userRepository;

    public RegisterServlet(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String email = request.getParameter("email");
        String password = request.getParameter("password");

        User user = new User(email, password);

        userRepository.save(user);
    }
}

The RegisterServlet class handles the registration process of a new user. It receives an HTTP POST request with 'email' and 'password' parameters and creates a new instance of User with these parameters.

The doPost method does not validate the uniqueness of the email. This means that if an attacker uses the plus character (+) in the email, the system will treat it as a unique email, even though it points to the same address. For example, [email protected] and [email protected] are treated as two different emails by the system, but both emails point to the same address [email protected].

This allows an attacker to create multiple accounts with the same email, which could be used to perform actions that are limited to one per account, bypass spam filters, or even to take over accounts.

Steps​

  • Validate email uniqueness during the registration process.
  • Implement a check to ensure that the email does not already exist in the system before saving the user.
  • Consider using a database query or an email validation service to check for existing email addresses.
  • If the email is already registered, display an error message to the user and prevent the registration process from proceeding.
  • Ensure that the email validation is performed on the server-side to prevent any client-side manipulation.
  • Consider implementing additional security measures such as rate limiting or CAPTCHA to prevent automated registration attempts.

Compliant code​

import javax.servlet.http.*;
import java.io.IOException;
import javax.servlet.ServletException;

public class RegisterServlet extends HttpServlet {

    private UserRepository userRepository;

    public RegisterServlet(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String email = request.getParameter("email");
        String password = request.getParameter("password");

        // Check if the email already exists in the system
        User existingUser = userRepository.findByEmail(email);
        if (existingUser != null) {
            // If the email is already registered, display an error message to the user and prevent the registration process from proceeding
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Email already registered");
            return;
        }

        User user = new User(email, password);

        userRepository.save(user);
    }
}

The updated code now includes a check to ensure that the email does not already exist in the system before saving the user. This is done by calling the findByEmail method on the userRepository object. If the findByEmail method returns a non-null value, it means that the email is already registered in the system. In this case, the servlet sends an error response to the client with the HTTP status code SC_BAD_REQUEST (400) and a message indicating that the email is already registered. If the findByEmail method returns null, it means that the email is not registered in the system, and the servlet proceeds to save the new user.

This solution ensures that the email uniqueness is properly verified during the registration process, preventing an attacker from creating several accounts pointing to the same email. It's important to note that this email validation is performed on the server-side, which prevents any client-side manipulation.

For additional security, consider implementing measures such as rate limiting or CAPTCHA to prevent automated registration attempts.

References​

Last updated on