SignUp API Exploit Add reCaptcha to register API

[codechefvit]

SignUp API Exploit Add reCaptcha to register API

[issue-label-bot]

Issue-Label Bot is automatically applying the label feature_request to this issue, with a confidence of 0.96. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[jugaldb]

Using the POST curl request anyone can flood the database with redundant info and make the site status to 500,0
So it would be better to add google ReCaptcha to register API to avoid any automated signups.

POC ( Proof Of Concept )

sudo curl -d "name=NAME&email=[email protected]&password=YOURPASSWD&mobileNumber=9999999999" -X POST https://quizzie-api.herokuapp.com/user/signup

A simple python script can be made to pass the parameter to the above Linux shell command and flood database.

OUTPUT LOG

ubuntu@ip-1XX-XX-X-XXX:$ sudo nano CChefAPISignUPCall.sh ubuntu@ip-1XX-XX-X-XXX:$ ./CChefAPISignUPCall.sh

{"message":"user created","userDetails":{"userId":"5f5de327e1a87300175828bf","email":"[email protected]","name":"admin","mobileNumber":9999999999}}

ubuntu@ip-172-31-4-127:~$

Adding ReCaptcha2.0 would resolve this conflict

Hi,

Thanks for pointing it out.

We have added it to our to do list and will implement it in the next release.

[akshatvg]

Added in latest PR.