I would like an option to restrict access to /login and /password_reset pages to only be viewable by people in our internal IP address range. Also would like to be able to remove the username, password, and password reset buttons on the home page in a non-CSS way. I have already hidden these buttons with CSS in the branding section, but anyone can inspect the page and immediately see the things that I am trying to hide and re-enable them on the client side. We just had a security review and received the following feedback: Disable or restrict direct LiquidFiles authentication paths if SSO is intended. Confirm whether the direct /login and /password_reset/new LiquidFiles workflows are required. If employees and users are expected to authenticate through the access portal/SSO flow, disable or restrict direct local authentication paths where feasible. Return generic password reset responses. Update the LiquidFiles password reset workflow to return the same response regardless of whether the submitted email address is associated with an account. For example: “If an account exists for the submitted email address, password reset instructions will be sent.” I turned off the friendly error messages to satisfy the second point. We use local accounts instead of SSO accounts for admin access. All local accounts are restricted to only being able to login from our internal networks. But they don't want these pages to be accessible at all for external users. I know that this is possible in the nginx conf files but I don't want to mess around with setting that might be overwritten in future updates. Thanks!
