SecurityInnovation/TMContentReview — Issue #26: Authentication Controls Fail Securely
Author: SergeTruth
Created: 2011-11-07 22:15:28+00:00
State: open

Need to stress the importance of reviewing authentication logic which relies on throwing different types of exception to determine the type of authentication failure which occurred. Examples include: BadPasswordException, PasswordExpiredException, LockedAccountException, etc. where the application can throw an unexpected exception which is not accounted for in the application and can cause unintended side effects (such as passing in an overly long string value).