Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

General Discussion

Posted by Ty Kelly
Ty Kelly
104 Points

Do we actually want to notify the user as to whether or not an email is in our database?

Just asking as I was wondering if it could eventually lead to a security issue.

Jacob Mishkin
Jacob Mishkin
23,118 Points

In what context? I would say if there is a need to notify the user about the status of the email I think it's fine. It comes down to what you are doing and the context of the relationship between the user and the email being in a database.

Ty Kelly
Ty Kelly
104 Points

In the context of a user requesting to reset an account's password. I was wondering if an application notified the requester as to whether or not a submitted email corresponds to a user's account (i.e. is in the database), could that create a situation where a "reset password" token could be discovered by an attacker because the app tipped that person off as to what email account to go after?