One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent" regardless of the e-mail being used or not for an account:
- there is no account using that e-mail: the e-mail is actually sent and an OK is responded
- an account using that e-mail exists: nothing is done and the same response is issued (OK)
This means that the client cannot understand what actually happened.
One of the project owners replied that this was intended to avoid a malicious party from checking if various e-mails are used for account of that service.
I am wondering if there is a middle ground between high security and a decent UX for the client.
I found a way that prevents batch checks by a third party by using an IP rate limiter (all requests for that endpoint are throttled. for example max 2 requests per 10s and 5 requests per minute from a certain IP). It is based on this answer and this library.
If an IP abuses that API method, it gets an HTTP 429 Too Many Requests response.
This does not prevent checking a small number of e-mail addresses, but it should prevent checking a large number of them.
Is there any better solution security-wise? I am asking especially because the referenced SO Q&A is rather old and things might have evolved in the meantime.