2020-06-30 12:50:28 +02:00
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
|
|
|
|
|
|
When a user performs a request involving a username, it should not be possible to spot differences between a valid and incorrect username:
|
2020-06-30 14:49:38 +02:00
|
|
|
|
2020-06-30 12:50:28 +02:00
|
|
|
* Error messages should be generic and not disclose if the username is valid or not.
|
|
|
|
|
* The response time must be similar for a valid username or not.
|
|
|
|
|
* CAPTCHA and other rate limiting solutions should be implemented.
|
