Currently, we don't take into account whether the username suggestion already exists. This is easily implemented, as we use HTMX (Ajax) for the username suggestion. BUT I am unsure if we actually want this?
What should we do, if the username actually exists? Add a 0 at the end of the username and recheck again, whether that one exists? This would cause us unnecessary resources and doesn't feel very good.
IMO this case is very rare anyway and if the user submits the form, he'll see, that the username exists and can adjust it accordingly, so I'd say, we leave this feature out of the picture.
What do you think @anybody?
Discuss whether too check if the username already exists.
Comments
Comment #2
grevil commentedComment #3
anybodyYes, but we should add a setting for that, because it allows user name enumeration attacks (finding out if a user name is used) - which is uncritical in most public cases, as the user names are public in general.
For that reason, make it a setting.
I in case a user name already exists, we should count up?
Comment #4
anybodyComment #5
anybodyComment #6
grevil commentedI'd say, we don't implement it at all? I only see downsides for this, as described in the issue summary. Not really big fan of this in general.
Comment #7
anybodyOk let's for now postpone this. Using a random suffix allows a valid workaround.