TechPrufer
Get started
Spotify
Spotify logoSpotify · Feature trail

Username Canonicalization and Security

1 post · May 2013

What this trail covers

Spotify's approach to username handling has evolved to address security vulnerabilities arising from complex Unicode characters. The system now ensures that usernames are canonicalized correctly and idempotently, preventing account hijacking through clever use of similar-looking characters. This involves rigorous validation of user input and robust handling of Unicode transformations to maintain system integrity and user security.

All Spotify trails
  1. Creative usernames and Spotify account hijackingThis post details a critical security incident where account hijacking was possible due to a non-idempotent username canonicalization process. The vulnerability stemmed from the XMPP nodeprep implementation not correctly handling Unicode characters outside of Unicode 3.2, leading to discrepancies between verbatim and canonical usernames. The fix involved a wrapper function to ensure idempotency and a temporary restriction on username registration until a more permanent solution was implemented. The root cause was traced back to a change in Python's standard library `unicodedata` module between versions 2.4 and 2.5, which affected the Twisted library's implementation.