Chapter 2 of 6 · 4 practices · 4 min · 4-question quiz
The login flow and brute force protection
How the sign-in endpoint should respond, how to slow down guessing without locking real users out, and what to record.
Start: Return the same response for unknown accounts and wrong passwords4 practices in this chapter
- 1Return the same response for unknown accounts and wrong passwordsIf your login says "No account with that email" for one input and "Wrong password" for another, anyone can test which emails are registered. That list feeds targeted phishing and credential stuffing…
- 2Do the same work whether or not the account existsEven with identical messages, a login can leak which accounts exist through response time. A common pattern looks up the user, and if there is none, returns immediately. Because password hashing is…
- 3Throttle failed logins per account, with lockouts that cannot be abusedAttackers guess passwords against one account (brute force) or try leaked pairs across many accounts (credential stuffing). OWASP recommends tracking failures per account rather than per IP address…
- 4Log every authentication event and alert on patternsYou cannot respond to an attack you cannot see. OWASP recommends logging and reviewing all authentication failures, password failures and account lockouts, and monitoring authentication in real time.
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.