Describe the bug

Currently, login requests will fail faster if the user does not exist as the hash does not have to be computed. This can leave to timing attacks where an attacker can guess if a user exists or not, which defeats account enumeration defenses.

Expected behavior

Every login request should take a similar amount of time regardless of whether the user exists or not. The

In order to make the email functionality work on my SMTP server (which forwards emails to a secure ISP relay), I had to make these changes in the userfrosting/app/sprinkles/core/config/default.php:

'port' => 25,
'auth' => false,
'secure' => 'false'

Please consider adding these options to the setup options (and documentation).
I had to create a PHPMailer application to debug my

The following guides may be improved with unit test examples:

• https://github.com/danschultzer/pow/blob/master/guides/custom_controllers.md
• https://github.com/danschultzer/pow/blob/master/guides/sync_user.md
• https://github.com/danschultzer/pow/blob/master/guides/lock_users.md
• https://github.com/danschultzer/pow/blob/master/guides/user_roles.md

There's alread

I would need to get each user's hourly rate using the API (this should be one of the user preferences): how should I do it?

I'm not sure if it's already feasible (and I just cannot find it) or if this is missing.

Thanks in advance for your help.

Ciao,
Alberto

Houseparty users can be found by checking the following URL: https://houseparty.com/add/{placeholder}.