OWASPASVS 5.0 requirement
ASVS-V6.3.8 Valid users cannot be deduced from failed authentication challenges, such as by basing on error messages, http response codes, or different…
- Standard
- OWASP ASVS 5.0
- Chapter
- V6 Authentication
- Section
- V6.3 General Authentication Security
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that valid users cannot be deduced from failed authentication challenges, such as by basing on error messages, HTTP response codes, or different response times. Registration and forgot password functionality must also have this protection.