Skip to content
Preventing username enumeration
portswigger.net | blog | #web-security | #authentication | #portswigger | #timing-attacks | #account-recovery | #username-enumeration | #account-registration
Summary
Preventing username enumeration takes more than uniform errors: timing and HTML differences leak answers, and registration needs designs like app-chosen usernames to avoid revealing valid accounts.
- Published
- Collected