Repository: web2py/web2py

Issue:
Allow auth.login() to return a specific error message
_From [markruol..._at_gmail.com](https://code.google.com/u/114619454780239522399/) on September 17, 2014 19:29:40_

Currently, auth.login() only returns a generic "invalid error" upon login error. 

However, the generic error message is no more secure than an error message detailing whether the password or username/email was incorrect, because the registration page already reveals whether or not a username/email is taken.

Returning a more specific error message upon login error would be a big usability improvement at no cost to security:
1. Is the username/email in the database?
2. Is the password correct for that username/email?

I understand that this is done to be compliant with OWASP, but as discussed here: https://groups.google.com/forum/#!topic/web2py/0zCjs2G9ucE , it seems it's possible to implement this feature without breaking OWASP compliance.

_Original issue: http://code.google.com/p/web2py/issues/detail?id=1984_



Discussion:
Yeah, that'd definitely be cool.

@leonelcamara are you planning on adding this? I ask you since I seen you post the best answer in the forum referenced. 
@amerikan yeah I can do it, I've just came back from vacation so I have a tough week ahead with the work that piled up but I'll try to get to it as soon as possible.
It’s not an urgency at all. I actually don’t need this myself, but I was just reviewing issues and saw your name.

Resolving patch:
diff --git a/gluon/tools.py b/gluon/tools.py
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -1378,6 +1378,7 @@ class Auth(AuthAPI):
                             login_after_password_change=True,
                             login_after_registration=False,
                             login_captcha=None,
+                            login_specify_error=False,
                             long_expiration=3600 * 30 * 24,  # one month
                             mailer=None,
                             manager_actions={},
@@ -2567,6 +2568,8 @@ def login(self,
                            settings.formstyle, 'captcha__row')
                 accepted_form = False
 
+                specific_error = self.messages.invalid_user
+
                 if form.accepts(request, session if self.csrf_prevention else None,
                                 formname='login', dbio=False,
                                 onvalidation=onvalidation,
@@ -2582,6 +2585,7 @@ def login(self,
                         user = table_user(**{username: entered_username})
                     if user:
                         # user in db, check if registration pending or disabled
+                        specific_error = self.messages.invalid_password
                         temp_user = user
                         if (temp_user.registration_key or '').startswith('pending'):
                             response.flash = self.messages.registration_pending
@@ -2631,7 +2635,7 @@ def login(self,
                         self.log_event(self.messages['login_failed_log'],
                                        request.post_vars)
                         # invalid login
-                        session.flash = self.messages.invalid_login
+                        session.flash = specific_error if self.settings.login_specify_error else self.messages.invalid_login
                         callback(onfail, None)
                         redirect(
                             self.url(args=request.args, vars=request.get_vars),


Test patch: