How to prevent user enumeration attacks through the Forgot Password functionality

Legacy Knowledge Base

Published Jul. 2, 2025

How to prevent user enumeration attacks through the Forgot Password functionality

Written By

Tibor Lipusz

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

Insecure default configuration may allow remote attackers to enumerate users' email addresses via the forgot password functionality. This can be a risk in the case of public-facing deployments.

Environment

Liferay DXP 6.2 EE
Liferay DXP 7.0-7.2

Resolution

It is recommended to set the portal property login.secure.forgot.password to true in your portal-ext.properties.

On the specified product versions, this property defaults to "false":

# Set this to true to prevent attempts to enumerate the portal's users via
# the forgot password feature. This feature will no longer show an error
# that would reveal a user's existence.
login.secure.forgot.password=false

To avoid causing unwanted behavior change in existing deployments, Liferay will not change this default setting in a Fix Pack/Service Pack.