> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Don't Forget Your Registration Form! - URL: https://securinglaravel.com/security-tip-dont-forget-your-registration/ - Published: 2024-02-23T06:00:39.000Z - Updated: 2025-09-10T11:25:15.000Z - Description: [Tip#72] We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel! - Author: Stephen Rees-Carter - Tags: Security Tips, Passwords I was ~~procrastinating~~ browsing Twitter and came across this wonderful meme: ![The full text is replicated below the meme.](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fsubstack-post-media.s3.amazonaws.com-2fpublic-2fimages-2f010c4db2-a3cc-4e19-b236-77eb33c4c0a5_1226x1227.jpg) Credit: [Tim Myers @denvercoder](https://twitter.com/denvercoder/status/1759025712382591213?ref=securinglaravel.com) In the first panel we have what is presumably a login form error message, giving an ambiguous message to obfuscate which input is incorrect: > “Error. Either your email or password is incorrect.” Followed by the response from the registration form, which confirms the email address is in the database: > Register > Enter Email: ”Sorry that email is taken.” > AH, it’s the password. Upon seeing this, my first reaction was… ***This is why ambiguous messaging on password reset forms is often pointless.*** ## How secure is your app? Sign up for ****Securing Laravel** to learn the essential security skills you need to keep your Laravel apps secure! You'll receive [weekly security tips](https://securinglaravel.com/tag/tips/) (like this one!), and upgrade to receive [monthly In Depth articles](https://securinglaravel.com/tag/in-depth/) that teach you so much more. You'll also be supporting Stephen's security work within the Laravel & PHP Community! Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. Folks spend so much time worrying about the password reset form leaking account existence and ensuring it has rate limiting, but what about the humble registration form? Not only do they usually tell you if an email address is already in the database, but they also often lack sufficient rate limiting, **and** don’t send out any emails, so you can usually use a registration form to check if email addresses are in the database much **faster and quieter** than with a password reset form. 😈 **Password Reset forms are often covered by heavy rate limiting, with verbose logging and alerting. While validation errors on registration forms are typically completely ignored. I know which I'd rather attack!* **So this week, I want you to remember your humble registration form!** 1. Ensure it has rate limiting that includes any validation failures. 2. If account attacks or credential stuffing are a concern, log those validation failures so you’re aware of malicious activity. 3. If the existence of email addresses is supposed to be secret, don’t validate emails on the registration form! 💡 Most apps don’t actually need to worry enumeration attacks, as user existence doesn’t reveal anything compromising, and the only benefit is to slow down credential stuffing attacks. However, if your app does need to protect user identities, your registration form shouldn’t validate email addresses. Instead, it should just collect all the user's information and notify the provided email address - either to inform the existing account owner of the attempt, or to confirm ownership of the address and continue the registration flow. See [In Depth: Registration Without Enumeration](https://securinglaravel.com/in-depth-registration-without-enumeration/) for more information on this topic. --- ***If you found this security tip useful?* 👍** [*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.* ***Want to learn more?* 🤓** *Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support) *or* [*recurring Sponsorship*](https://securinglaravel.com/sponsor/)*! Your support directly funds my security work in the Laravel community.* 🥰 **Need a second set of eyes on your code?** *Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.* *Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*