Skip to content

Secure User Authentication Logic to Prevent User Enumeration #265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vishwab1 merged 1 commit into from
Jul 8, 2025
Merged

Secure User Authentication Logic to Prevent User Enumeration #265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/main/java/com/iemr/common/controller/users/IEMRAdminController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -620,10 +620,10 @@ public String forgetPassword(

if (mUsers == null || mUsers.size() <= 0) {
logger.error("User not found");
throw new IEMRException("If the username is valid, you will be asked a security question");
throw new IEMRException("If the username is registered, you will be asked a security question");
} else if (mUsers.size() > 1) {
logger.error("More than 1 user found");
throw new IEMRException("If the username is valid, you will be asked a security question");
throw new IEMRException("If the username is registered, you will be asked a security question");

} else if (mUsers.size() == 1) {
List<Map<String, String>> quesAnsList = new ArrayList<>();
Expand Down
47 changes: 31 additions & 16 deletions src/main/java/com/iemr/common/service/users/IEMRAdminUserServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,16 +220,19 @@ public void setValidator(Validator validator) {
this.validator = validator;
}

private void checkUserAccountStatus(User user) throws IEMRException {
if (user.getDeleted()) {
throw new IEMRException("Your account is locked or de-activated. Please contact administrator");
} else if (user.getStatusID() > 2) {
throw new IEMRException("Your account is not active. Please contact administrator");
}
}

@Override
public List<User> userAuthenticate(String userName, String password) throws Exception {
List<User> users = iEMRUserRepositoryCustom.findByUserNameNew(userName);
if (users.size() != 1) {
throw new IEMRException("Invalid username or password");
} else {
if (users.get(0).getDeleted())
throw new IEMRException("Your account is locked or de-activated. Please contact administrator");
else if (users.get(0).getStatusID() > 2)
throw new IEMRException("Your account is not active. Please contact administrator");
}
int failedAttempt = 0;
if (failedLoginAttempt != null)
Expand All @@ -241,6 +244,7 @@ else if (users.get(0).getStatusID() > 2)
int validatePassword;
validatePassword = securePassword.validatePassword(password, user.getPassword());
if (validatePassword == 1) {
checkUserAccountStatus(user);
int iterations = 1001;
char[] chars = password.toCharArray();
byte[] salt = getSalt();
Expand All @@ -254,29 +258,37 @@ else if (users.get(0).getStatusID() > 2)
iEMRUserRepositoryCustom.save(user);

} else if (validatePassword == 2) {
checkUserAccountStatus(user);
iEMRUserRepositoryCustom.save(user);

} else if (validatePassword == 3) {
checkUserAccountStatus(user);
iEMRUserRepositoryCustom.save(user);
} else if (validatePassword == 0) {
if (user.getFailedAttempt() + 1 >= failedAttempt) {
if (user.getFailedAttempt() + 1 < failedAttempt) {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("User Password Wrong");
throw new IEMRException("Invalid username or password");
} else if (user.getFailedAttempt() + 1 >= failedAttempt) {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user.setDeleted(true);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("User Account has been locked after reaching the limit of {} failed login attempts.",
ConfigProperties.getInteger("failedLoginAttempt"));

throw new IEMRException(
"Your account has been locked due to multiple failed login attempts. Please contact administrator.");
"Invalid username or password. Please contact administrator.");
} else {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("Failed login attempt {} of {} for a user account.",
user.getFailedAttempt(), ConfigProperties.getInteger("failedLoginAttempt"));
throw new IEMRException(
"Your account has been locked due to multiple failed login attempts. Please contact administrator.");
"Invalid username or password. Please contact administrator.");
}
} else {
checkUserAccountStatus(user);
if (user.getFailedAttempt() != 0) {
user.setFailedAttempt(0);
user = iEMRUserRepositoryCustom.save(user);
Expand Down Expand Up @@ -310,11 +322,6 @@ public User superUserAuthenticate(String userName, String password) throws Excep

if (users.size() != 1) {
throw new IEMRException("Invalid username or password");
} else {
if (users.get(0).getDeleted())
throw new IEMRException("Your account is locked or de-activated. Please contact administrator");
else if (users.get(0).getStatusID() > 2)
throw new IEMRException("Your account is not active. Please contact administrator");
}
int failedAttempt = 0;
if (failedLoginAttempt != null)
Expand All @@ -326,6 +333,7 @@ else if (users.get(0).getStatusID() > 2)
int validatePassword;
validatePassword = securePassword.validatePassword(password, user.getPassword());
if (validatePassword == 1) {
checkUserAccountStatus(user);
int iterations = 1001;
char[] chars = password.toCharArray();
byte[] salt = getSalt();
Expand All @@ -339,27 +347,34 @@ else if (users.get(0).getStatusID() > 2)
iEMRUserRepositoryCustom.save(user);

} else if (validatePassword == 2) {
checkUserAccountStatus(user);
iEMRUserRepositoryCustom.save(user);

} else if (validatePassword == 0) {
if (user.getFailedAttempt() + 1 >= failedAttempt) {
if (user.getFailedAttempt() + 1 < failedAttempt) {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("User Password Wrong");
throw new IEMRException("Invalid username or password");
} else if (user.getFailedAttempt() + 1 >= failedAttempt) {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user.setDeleted(true);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("User Account has been locked after reaching the limit of {} failed login attempts.",
ConfigProperties.getInteger("failedLoginAttempt"));

throw new IEMRException(
"Your account has been locked due to multiple failed login attempts. Please contact administrator.");
"Invalid username or password. Please contact administrator.");
} else {
user.setFailedAttempt(user.getFailedAttempt() + 1);
user = iEMRUserRepositoryCustom.save(user);
logger.warn("Failed login attempt {} of {} for a user account.",
user.getFailedAttempt(), ConfigProperties.getInteger("failedLoginAttempt"));
throw new IEMRException(
"Your account has been locked due to multiple failed login attempts. Please contact administrator.");
"Invalid username or password. Please contact administrator.");
}
} else {
checkUserAccountStatus(user);
if (user.getFailedAttempt() != 0) {
user.setFailedAttempt(0);
user = iEMRUserRepositoryCustom.save(user);
Expand Down
Loading