When authenticating a form on your web application, you must be careful not to display just one error message. Displaying a specific error message is dangerous because it could let an attacker use an automated trial-and-error method to determine a user’s username and password. Injection attacks, memory leaks, and compromised
Table of contents
What is Authentication?Displaying Specific Error MessagesIntegrating Session IDs into a URLIncorrect form validation.Low form SanitizationOpen Source Session ReplayWeak Password StrategyFailure to use Two-Factor AuthenticationImproper Password ResetInsecure LogoutBrute Force AttackUsing Insufficient Security QuestionsFailure to safeguard routesConclusion4 Comments
Sort: