No error when entering no listed mail

[svenvanginkel]

What is the name of the domain?

example.com

What is the issue you’re encountering

No error when entering no listed mail

What steps have you taken to resolve the issue?

I have setup the OTP in Zero trust. All works when I access the url the auth is presented, enter the listed mail address, get the code and I can access the website.
When i enter a mail address to does not have access. it will still say the code is sent, which is not the case. So I geuss it works. But I would expect a “not allowed” page when entering a not listed mail address.

Screenshot of the error

[sjr]

@svenvanginkel

When i enter a mail address to does not have access. it will still say the code is sent, which is not the case. So I geuss it works. But I would expect a “not allowed” page when entering a not listed mail address.

This is the expected behaviour. It prevents determining if an email address is permitted access or not which would narrow down potential targets for phishing. You can enter any email address into the zero trust login and it will always say an email was sent.

[svenvanginkel]

I had the idea it was that. Thanks for comfirming