fix: prevent user email side-channel leak on verify

supabase · Mar 5, 2024 · 18631fb · 18631fb
1 parent b5566e7
commit 18631fb
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/internal/api/verify.go b/internal/api/verify.go
@@ -625,7 +625,7 @@ func (a *API) verifyUserAndToken(conn *storage.Connection, params *VerifyParams,
 
 	if err != nil {
 		if models.IsNotFoundError(err) {
-			return nil, notFoundError(err.Error()).WithInternalError(err)
+			return nil, expiredTokenError("Token has expired or is invalid").WithInternalError(err)
 		}
 		return nil, internalServerError("Database error finding user").WithInternalError(err)
 	}