500 on login when account is not registered

[Harm-Nullix]

Checklist

• I could not find a solution in the existing issues or docs.
• I agree to follow this project's Code of Conduct.

Describe the bug

When this toggle is off:

We used to get a nice error message that just states "account not found" or something generic when we have this toggle off, now we get an 500 error screen

Reproducing the bug

Set the privacy toggle to "Off" which means do not expose detail error message.

Try a login screen with an unkonwn email,
You will get this screen (in dutch):

Logs

curl 'https://auth-dev.pgbeetje.nl/login?action=continue_with_login_identifier%406096f208-70e8-4c24-b705-e7a8209b7c43' \
  -X POST \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0' \
  -H 'Accept: application/json' \
  -H 'Accept-Language: nl,en-US;q=0.9,en;q=0.8' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Content-Type: application/json' \
  -H 'X-Language: nl' \
  -H 'Origin: http://localhost:3027' \
  -H 'Sec-Fetch-Storage-Access: none' \
  -H 'DNT: 1' \
  -H 'Sec-GPC: 1' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Connection: keep-alive' \
  --data-raw '{"input_data":{"identifier":"harm_budgethddsadsaouder@nullix.nl"},"csrf_token":"Htx0JLUHzAbtJJSqssW3nvLirsHwcsZ1"}'

Response:
{"name":"error","status":500,"payload":{},"csrf_token":"tCErDpUm78l4tZUm0SJnWtpWSrMeAoSc","actions":{},"error":{"code":"flow_discontinuity_error","message":"The flow can't be continued."},"links":null}

Configuration

Hanko Version

2.5.0

OS Hanko Backend

None

OS Version Hanko Backend

No response

OS

macOS

OS Version

MAcOS 26.3 (25D125)

Browser Version

Firefox 148.0 (aarch64)

Environment

None

Additional Context

I am just using Hanko Cloud.
You may check our config in Hanko:

organizations/5671afbf-f9ae-46a2-a6be-2b80dd321bb1/projects/2aca895a-d2a5-4389-8a18-423642acdab9

[Harm-Nullix]

I've got some mail responses coming through, I think regarding to testing or maybe a queue that is being cleaned?

[FlxMgdnz]

Hi @Harm-Nullix, thanks for the bug report.

We investigated the situation, and the issue seems to stem from the interaction between the two privacy settings. If the first setting, Show account existence hints, is disabled, while Hide unavailable login methods is enabled, the system ends up in an unclear state when an unknown user (who has no authentication methods at all) tries to sign in. In that case, the error you’re seeing is shown. At least that’s where our analysis currently stands.

We’ve been discussing adjusting the behavior here. Our idea would be that, if the user is unknown (which we don’t want to reveal when Show account existence hints is disabled), the other setting would simply be ignored and instead all authentication methods configured for the tenant would be offered.

Does that make sense, and would that explain the behavior you’re seeing in your project?

[Harm-Nullix]

I let my mind wonder yesterday: Currently (with the bugged flow) it still shows some sort of account existence, because you either go to the "choose password method" OR you get the "Process could not be continued", which still leaks if a user does exists or not. So a change is needed I think

MO about the options:

I think the result of your discussion is valid. You would not want to hide unavailable options if you do not have any accounts hints because this is an account hint in itself (even it it is a step further in the process)

Suggestions for admin interface
I would disable the second option "methods" or give some sort of informational text to tell that this option is a extend
(Or choose another way, I am not an UX'er 😉 )

UX changes for frontend SDK:
For the user I would suggest changing the text:

To

e.g.:

"If this email address is known to us, you will receive an email with a code. Enter the code below."
"Wenn uns diese E-Mail-Adresse bekannt ist, erhalten Sie eine E-Mail mit einem Code. Geben Sie den Code unten ein."

WHY?
This makes it for the user known that you do not acknowledge that the email is valid and known and easier to understand the "why" to why a mail would not be delivered.
This is a choice we made in our own translations for Hanko, it would be something to take up in changing the translation (or adding a extra translation key for when you use the privacy setting)

[FlxMgdnz]

I let my mind wonder yesterday: Currently (with the bugged flow) it still shows some sort of account existence, because you either go to the "choose password method" OR you get the "Process could not be continued", which still leaks if a user does exists or not. So a change is needed I think

Yes, you're right. The settings are not independent. I think that if we handle the invalid combination as I described above, the issue would be mostly solved. However, there would still be the problem that if not all potentially available auth methods are shown in step 2, it is possible to infer that the account exists, which effectively defeats the purpose of disabling "Show account existence hints". Cc @lfleischmann.

Changing the text in the passcode view the way you suggested seems like a good idea. Thanks!