Skip to content

security: User Account Naming Security #234

@alexskr

Description

@alexskr

This request addresses several security concerns regarding user account naming. The proposed changes aim to reduce potential vulnerabilities and ensure a consistent, secure handling of usernames across the system.

Proposed Changes:

  • Restrict usernames to alphanumeric characters plus a limited set of extra characters deemed safe.
    Period (.)
    Plus (+)
    Underscore (_)
    Dash (-)
    At symbol (@)
    Space ( )?
    Note: Further review may refine this list based on security best practices.

  • Case-Insensitive Uniqueness
    Usernames must be treated in a case-insensitive manner to prevent accounts such as Admin, admin and ADMIN from being considered distinct

  • Maximum Length Restriction

  • Blacklist of Reserved or Unsafe Usernames
    Prevent the registration of usernames that are known to be sensitive or prone to abuse, such as "admin", "root", "support", etc, that cannot be registered by end users.

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions