Web Security / Sessions and logins
Lesson 18 of 27
Account enumeration
If a login form says 'that user doesn't exist', attackers learn which usernames are real. Give the same message for a wrong username or a wrong password.
Key points
- One message: 'Wrong username or password'
- Same for password resets
- Keep response times similar
Quiz · +10 XP
Which login error message is safest?
Log in to save progress and earn XP.