A failed login should not broadcast details of the attempt

[JamesGardiner]

This service currently logs whether a username is registered or not when a failed login attempt is made. This is poor practice from a security perspective.

ras-frontstage/frontstage/views/passwords/forgot_password.py

Line 54 in d030e88

template_data = {"error": {"type": {"Email address is not registered"}}}

If there is an API failure (we couldn't talk to the service to find out if the email is registered) -> display an error page

Not registered -> display the 'we sent an email to that user with details' page

Registered -> display the 'we sent an email to that user with details' page

At no point should either the password or username/email address form data be logged (because some user will undoubtedly put their password in the username field that will then end up in our log files as plaintext).

[jcox-dev]

I think this has been fixed now?