If we only allow the letters a-z and A-Z then we could canonicalize a username by mapping all characters to lower case: canonical_username = username.lower() # in python The latter is often implemented by canonicalizing the username.

The first is an example of forbidding certain characters in usernames and the second is to treat some characters (‘B’ and ‘b’) as equivalent.

treat “BigBird” and “bigbird” as the same username.

If you allow your users to pick their usernames too freely they may accidentally shoot themselves (or you) in the foot. We had no option except to disable account creation until we could prevent the attack.įorbidden and equivalent characters in usernames

Now, instead of logging in to account with username ᴮᴵᴳᴮᴵᴿᴰ, try logging in to account with username bigbird with the new password.įrom the log lines associated with the hijacking of the forum manager’s account it appeared to be a problem with how we derived a canonical username from the username the user chooses at registration, but we were still pretty much in the dark.A password reset link is sent to the email you registered for your new account.Send a request for a password reset for your new account.Create a new spotify account with username ᴮᴵᴳᴮᴵᴿᴰ (in python this is the string u’ᴮᴵᴳᴮᴵᴿᴰ′).For the sake of this example let us hijack the account belonging to user bigbird. From the forum post we knew that taking over an account went something like this: Our forum manager challenged the user to take over his account, and within minutes the manager’s account had a new playlist added and a new password.Ī bunch of us dropped whatever we were working on and scurried to try to understand what was going wrong and how to fix it. Some years ago, late on Good Friday, a user posted on the Spotify support forum that he and a friend could hijack user accounts. This is the story of one time when it bit us pretty badly and how we spent Easter dealing with it. However, it has also been a reliable source of pain over the years. Spotify supports unicode usernames which we are a bit proud of (not many services allow you to have ☃, the unicode snowman, as a username).

Spotify account manager