Is it ok to expose messages from the `IdentityError` class?

Question

I'm quite new to the asp.net core identity framework. Many tutorials, articles and guides seem to handle an IdentityError in the same way. They expose the description of the error to the user, i.e. they add the description of the error to the ModelState.

It's been drummed into my head that exposing errors to the user is a terrible idea as it empowers attackers.

So I thought, It must depend on what kind of information is available in the description. For example, if the error is "Your password is too weak" or "You need to enter in a valid e-mail address". That type of information is valuable to the user and should be ok to display. However a "The data source took too long to respond" is already too much information and offers little value. I'd rather catch that type of error and replace it with some generic 500 error.

So my question: Is it safe to show the raw Identity Error to the user? If not how can I filter what I should and Should not show to the user?

I tried looking at the MSDN docs to understand all the possible codes that I could receive. But those docs offer very little information.

I am specifically working with

var userCreationResult = await userManager.CreateAsync(newUser, password);

But it applies to any instance when an IdentityError might appear.

Answer 1

Many software quality and security regulations have audit requirements for this (no error message presented to end users may contain information that is secret or would enable users with malicious intent to compromise the system or access sensitive data), so this is an important question. If there is a documentation or article specifically addressing this, then it is well hidden.

The possible values that the two members of the IdentityError class can assume, are baked into the framework. So it looks like you can be sure that it will always be one of those, unless a you obtain an instance of IdentitiyError from anything else than a UserManager.

The Code field is assigned from nameof of the error method, and the associated Description text is read from core framework resources, so those will be localized.

Source Code
en-us Descriptions

List of errors in current implementation (version 3.0.0):

• DefaultError
• ConcurrencyFailure
• PasswordMismatch
• InvalidToken
• RecoveryCodeRedemptionFailed
• LoginAlreadyAssociated
• InvalidUserName
• InvalidEmail
• DuplicateUserName
• DuplicateEmail
• InvalidRoleName
• DuplicateRoleName
• UserAlreadyHasPassword
• UserLockoutNotEnabled
• UserAlreadyInRole
• UserNotInRole
• PasswordTooShort
• PasswordRequiresUniqueChars
• PasswordRequiresNonAlphanumeric
• PasswordRequiresNonAlphanumeric
• PasswordRequiresLower
• PasswordRequiresUpper

Most of these are static strings and do not disclose any variable information.

The following do disclose variable information. This is data previously supplied by the user anyway in the first eight cases, and the value of a server configuration property in the last two cases, minimum required password length and minimum number of unique characters required in a valid password:

• InvalidUserName: the user name
• InvalidEmail: the email address
• DuplicateUserName: the user name
• DuplicateEmail: the email address
• InvalidRoleName: the name of the role
• DuplicateRoleName: the name of the role
• UserAlreadyInRole: the name of the role
• UserNotInRole: the name of the role
• PasswordTooShort: the minimum password length
• PasswordRequiresUniqueChars: the number of unique chars required

If that qualifies as "safe" within the constraints and specifications of your project, then the answer is yes.

Answer 2

Regarding your second question on how to do, you could do the following to filter out a duplicate username as you loop through errors

                if (error.Code == _userManager.ErrorDescriber.DuplicateUserName(user.UserName).Code)
                {
                    //Hide info to user by, e.g. redirecting to a page for a registration flow, or display an invalid login attempt for a login flow
                }