Recent changes to default settings have completely messed up user creation. normalize_emails setting is on by default, which means it is no longer possible to create a user with a + address (e.g. nikki+testuser@example.com). hide_email_address_taken is on by default, which means it is no longer possible to determine the user id from the return of the create user API call. The create user API call returns success even if the specified user already exists, or the email address is duplicate (so the user didn’t get created) The create user API call lies about whether the user is active or not (the active flag does not agree with the message) The Get User By Email call no longer works (admin/users/list/all with email=the user’s email). It returns null for an address containing +, even if normalize_emails and hide_email_address_taken are both off Can this be fixed so it works consistently and correctly, please?

For the record, some of those were discussed here: [image] User creation API: ‘active’ attribute set to True but returns False in response Support [A screenshot of a website settings page with a red box highlighting the "normalize emails" setting. (Captioned by AI)] Yes, it seems that the reason for the failure was the flag normalize_email:true it’s true by default. As I turned it off the users got created… However, the API is not considering the normalize_emails flag and is returning success eventhough the user never got created or activated for that matter confused Should I report this in discourse github ?

[image] Nikki Locke: normalize_emails setting is on by default So change it back? [image] Nikki Locke: hide_email_address_taken is on by default, So change it back. [image] Nikki Locke: The create user API call returns success even if the specified user already exists That’s the problem with security; it inconveniences mostly the Good People. [image] Nikki Locke: The Get User By Email call no longer works (admin/users/list/all with email=the user’s email). It returns null for an address containing +, even if normalize_emails and hide_email_address_taken are both off That (and maybe number 4) sounds like a bug, regression, or unexpected edge case.

Thanks, but how do I find out if someone is looking at these bugs?

The only one that is likely to be a bug is the lookup. That feature works in the front end, though, so it’s also unlikely that it’s a bug. For someone to treat anything as a big it’ll need to be documented as such.

User creation via API is a mess!

Product Support

pfaffman (Jay Pfaffman) January 14, 2025, 2:53pm 3

So change it back?

So change it back.

That’s the problem with security; it inconveniences mostly the Good People.

That (and maybe number 4) sounds like a bug, regression, or unexpected edge case.

Topic		Replies	Views
Create-User via REST-API, does not seem to be working Product Support	5	362	March 3, 2025
User creation API: ‘active’ attribute set to True but returns False in response Product Support rest-api	10	427	January 1, 2025
API, create user, no longer returns user_id Product Support	8	434	April 17, 2025
New signup with old email including + doesnt work in rest API Product Support	13	767	June 8, 2023
Cant create active user via api, Again Product Support	1	580	April 8, 2021

User creation via API is a mess!

Related topics