Enumeration of registered email addresses via user profile API

[sveeke]

BadgeUserProfile uses BadgeUserProfileSerializer which responds to registration attempts with this error message:

Account could not be created. An account with this email address may already exist.

This API endpoint can be accessed by sending a POST request to v1/user/profile. It expects these fields as parameters:

first_name = serializers.CharField(max_length=30, allow_blank=True)                
last_name = serializers.CharField(max_length=30, allow_blank=True)                 
email = serializers.EmailField()                                                   
password = serializers.CharField(style={'input_type': 'password'}, write_only=True)

[ottonomy]

This is a valid issue. There may be some potential for data leak. The account cannot be created, so some error message must be returned. It is possible to be even less specific in the error message trading off protection against this potential data leak for a more confusing user experience.

[sveeke]

@ottonomy has something been changed in Badgr because of this issue?