[FIXED] Mysterious users in my database that didn't come from my registration process

Issue

I have a Laravel-5.5 application in development with a live test application exposed on Google App Engine. My registration process includes the standard Auth registration from Laravel. The RegisterController then redirects to a profile page if there isn't one for the user already.

    public function redirectTo()
{
    if (!Auth::user()->profile)
    {
        return '/profile';
    }
    else 
    {
        return $this->redirectTo;
    }
}

The profile controller creates a new userprofile record for the user automatically as the page loads.

$(document).ready(function () 
    {
        ...
        getProfileData(profileId);
                    ...
    });

getProfileData() posts to the controller. If ProfileId is empty, the controller creates a new record and sends a verification email to the registered address.

How can a user be created without then being redirected and a profile being created?

Users are being created on the live site without profiles or sent verification emails. The user_agent in the session records for these users appear to be real.

Any ideas about how these users are being created and how to stop it would be most helpful.

Solution

I believe that Laravel is actively being attacked by actors that are seeking sites with poor security practices. It starts with visiting the site and getting an active session, Then harvesting the sessions csrf-token and using the token in a non site generated post (crawler?) to the standard Laravel registration route.

Since my site has a two part registration that generates a profile and the profile needs to be verified by a human before access is granted, registering and then ignoring the response's redirect to the profile page gets the partially completed registration.

To stop the resulting database clutter in the users table I changed both the standard authentication routes and the expected fields that are returned from the registration form.

Since these changes I have had no half registered users show up in the database. I'll update this answer if I ever see more of this activity.

Answered By - Kelly MacInnis