Username Enumeration Prevention

Username Enumeration Prevention is a project which aims to mitigate common ways of anonymous users identifying valid usernames on a Drupal 8+ site.

What Is Username Enumeration?

Username enumeration is a technique used by malicious actors to identify valid usernames on a web application, which can then be used in other attacks such as credential stuffing.

What does Username Enumeration Prevention do?

• Provides warnings on admin status report if site is configuration could expose usernames
• Prevents password reset form from displaying the following messages
  • '%name is blocked or has not been activated yet.'
  • '%name is not recognized as a username or an email address.'
• Converts 403 Access Denied responses to 404 Not Found on user profiles.

Drupal 7 Note: If you're using Drupal 7.83 or above, you can safely remove this module, as its functionality have been brought into core

Additional Notes

Enabling this module is one step to preventing the usernames on the system from being found out but there are other known methods that are just as easy.

• If a user belongs to a role that has "access user profiles" granted to it, then that user can serially visit all integers at the URL http://drupal.org/user/UID and get the username from the loaded profile pages.
• "submitted by" information on nodes or comments, views, exposed filters or by other contributed modules can also expose usernames. Site builders looking to hide usernames from comments and nodes should look at using realname or some other tool.
• Browser autocompletion on the user login page can be disabled using the Security Kit module.
• The Drupal security team does not consider username enumeration a vulnerability.

Core Issue

Anyone looking to contribute to this project should first review the core issue and see if there is any way they can help push that forward.

Get Started

Composer

• Add the project to your project's composer dependencies.
  

  composer require "drupal/username_enumeration_prevention"

• Navigate to Administer >> Extend.
• Enable Username Enumeration Prevention.

Manual

• Place the entirety of the module directory in
  modules/contrib/username_enumeration_prevention.
• Navigate to Administer >> Extend.
• Enable Username Enumeration Prevention.