Suggest an Idea

[anagarju]

Description:
Using differences in responses from the application, it is possible to determine accounts that exist within the application and accounts that do not. These differences in responses can be used by an attacker to identify existing or active accounts, and the information gathered can be used to aid in additional attack scenarios

Mitigation Recommendations:
Avoid providing specific reasons for failure and use generic responses instead when possible. This will help ensure that attackers cannot obtain more information about accounts than necessary.
Examples for possible remediation:
Login
• Make sure to return a generic “Username or password is incorrect” message when a login failure occurs.
• Make sure the HTTP response, and the time taken to respond are no different when a username does not exist, and an incorrect password is entered.

[anagarju]

Reference support ticket: https://community.qlik.com/t5/crmsupport/casepage/issue-id/00034362/issue-guid/5003z00002V50IqAAJ/is...

[Meghann_MacDonald]

From now on, please track this idea from the Ideation portal. 

Link to new idea

Meghann

NOTE: Upon clicking this link 2 tabs may open - please feel free to close the one with a login page. If you only see 1 tab with the login page, please try clicking this link first: Authenticate me! then try the link above again. Ensure pop-up blocker is off.