# Elke unicode-teken kan worden uitgebuit op de gebruikersnaam

**URL:** https://meta.discourse.org/t/any-unicode-character-can-be-exploited-onto-the-users-name/263032
**Category:** Bug
**Created:** [27 april 2023 om 06:13 UTC](https://meta.discourse.org/t/any-unicode-character-can-be-exploited-onto-the-users-name/263032 "2023-04-27T06:13:59Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [2 mei 2023 om 07:33 UTC](https://meta.discourse.org/t/any-unicode-character-can-be-exploited-onto-the-users-name/263032/7 "2023-05-02T07:33:21Z")

</div>

Thanks for reporting that issue.

The `unicode usernames` site setting is off by default and we recommend configuring the `allowed unicode username characters` site setting in order to prevent issues like these, so this isn’t a huge issue (see [Unicode usernames and group names](https://meta.discourse.org/t/unicode-usernames-and-group-names/117737)).

Still, I’ve created a fix which will always prevent the usage of invisible characters in usernames even for those who haven’t configured the allowlist.

[https://github.com/discourse/discourse/pull/21331](https://github.com/discourse/discourse/pull/21331)

---

_[View the full topic](https://meta.discourse.org/t/any-unicode-character-can-be-exploited-onto-the-users-name/263032)._