about summary refs log tree commit diff
diff options
context:
space:
mode:
authorYann GUERN <y.guern@rock-hosting.com>2017-04-11 14:21:15 +0200
committerEugen <eugen@zeonfederated.com>2017-04-11 14:21:15 +0200
commita85d4473aa2a6a619fcee851c642dca576e622f6 (patch)
treee829221acf96a6619f7e1b7812969ad4b1eb2f69
parentc9b92259515a3eb16a9709c3c1e505f5fe3a33bc (diff)
Avoid user enumeration with devise paranoid mode (#1527)
-rw-r--r--config/initializers/devise.rb3
1 files changed, 2 insertions, 1 deletions
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index ede6640bb..3c23e7b2e 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -74,7 +74,8 @@ Devise.setup do |config|
   # It will change confirmation, password recovery and other workflows
   # to behave the same regardless if the e-mail provided was right or wrong.
   # Does not affect registerable.
-  # config.paranoid = true
+  # See : https://github.com/plataformatec/devise/wiki/How-To:-Using-paranoid-mode,-avoid-user-enumeration-on-registerable
+  config.paranoid = true
 
   # By default Devise will store the user in session. You can skip storage for
   # particular strategies by setting this option.