cens/ohmageServer — Issue #221: Supplying an unknown username gives a different message than supplying an incorrect password
Author: falquaddoomi
Created: 2012-02-28 23:02:36+00:00
State: open

For security reasons, it's best if the message is the same (e.g. "Incorrect username or password"). Having a different message might allow an attacker to compile a list of valid usernames, or at least be sure that the username they're attempting to crack is valid.