Hide whether an email is already registered
Environments can hide whether an email is already registered during sign-up.
From the changelog: Account enumeration prevention
Authdog Team
A sign-up form that says "this email is already registered" is a directory oracle. Attackers use it to build a list of valid accounts before stuffing passwords or bombing MFA. Environments can now hide whether an email is already registered during sign-up.
This is the longer note behind the August 2 changelog entry.
How it works
Prevent account enumeration is a toggle under environment security settings (Users > Settings, General Security Settings). When it is on, a sign-up for an address that already exists returns a success-shaped response. The client does not learn that the account was already there.
When it is off, sign-up can still reveal a collision the way it did before. That is convenient for debugging and for some admin-created flows; it is the oracle.
The flag is environment-scoped. Enabling it in prod does not change dev. Hosted sign-up and the identity sign-up API both honor the environment setting.
This toggle does not disable sign-up. Enable user registration and waitlist / restriction policies still decide whether a new account may be created at all.
Set it up
In the Authdog console, select the project and environment:
- Open Users > Settings.
- Under General Security Settings, enable Prevent account enumeration.
- Save.
- On the hosted Account Portal, attempt sign-up with an email that already exists and with one that does not. The success-shaped path should not distinguish them in the response the page shows.
The same card also holds Email OTP, Email/Password, MFA, account deletion, and impersonation. Those are separate controls.
Trust boundaries
A success-shaped sign-up is not a new session and not proof the password was accepted. Existing users still sign in through sign-in. Do not email "welcome, you are new" from the client based only on that response.
Enumeration prevention is not captcha, rate limiting, or Lidar. Pair it with bot protection and registration policy so the success-shaped path is not a cheap write oracle either.
Timing and mail delivery can still leak. If your app sends a different email for "already registered" versus "verify your address," the toggle cannot hide that. Keep those messages aligned when the flag is on.
Try it
Turn the toggle on in a non-production environment and compare sign-up for a known user versus a new address. The setting is documented in Users. The original release note is in the changelog.