authentication/error_messages

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Generic authentication error messages prevent user enumeration

An application must respond with a generic error message regardless of whether: the user ID or password was incorrect; the account does not exist; the account is locked or disabled. This prevents creation of a discrepancy factor that allows attackers to mount user enumeration attacks.

Generic login error response example

Correct login error response: 'Login failed; Invalid user ID or password.' Incorrect examples: 'Login for User foo: invalid password.', 'Login failed, invalid user ID.', 'Login failed; account disabled.', 'Login failed; this user is not active.'

Generic password recovery error response example

Correct password recovery error response: 'If that email address is in our database, we will send you an email to reset your password.' Incorrect examples: 'We just sent you a password reset link.', 'This email address doesn't exist in our database.'

Generic account creation error response example

Correct account creation error response: 'A link to activate your account has been emailed to the address provided.' Incorrect examples: 'This user ID is already in use.', 'Welcome! You have signed up successfully.'

Avoid different HTTP status codes for authentication results

The application may return different HTTP status codes depending on authentication attempt response. Even though a generic error page is shown to users, different HTTP response codes (such as 200 for success vs 403 for failure) can leak information about whether the account is valid or not. Consult the error handling cheat sheet for global handling of different errors in an application.

Prevent timing attacks in authentication

Authentication implementations must process requests in approximately the same response time regardless of whether the user exists or the password is correct, to prevent timing attacks that allow attackers to differentiate between wrong usernames and wrong passwords. Process the same steps (hash password and lookup credentials) for all authentication attempts rather than using quick-exit approaches.

Generic error messages to prevent account enumeration

On login, registration, and password reset, use identical error messages whether or not the account exists, such as 'Either the username or password was incorrect' or 'If this account exists then a reset token will be sent to the registered email address'. This prevents attackers from enumerating valid accounts.

Response timing attack prevention for account enumeration

Ensure that response content and timing behavior are identical whether or not the account exists. If responses take 50% longer for real accounts, membership information can be guessed and tested by measuring response times.

Give your agent this brain