How to protect a website managed by keycloak from abusing the "forget password" as a way to spam a user?

user_10353531 0
Viewed 578

I'm working on a website that will be managed by keycloak, there is an option to configure a realm to have a "forget password" functionality.

My question is how to protect against the option of abusing the "forget password" option by sending multiple requests and spamming a user ?

I was checking KeyCloak forums and documentation but couldn't find any information about it. any help will be much appreciated.

keycloak
1 Answers

There's currently no way of doing this, as far as I know, unless you write some rule in your smtp server for stopping the server sending mails to the same user beyond a concrete threshold in a time interval. There are some plans to include a captcha in the flow, for the 5.x version, though.

user_11991320
Related