---
id: 2325
title: "Preventing username enumeration"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/preventing-username-enumeration"
published_at: "2007-04-22T11:54:00Z"
tags: ["web-security", "authentication", "portswigger", "timing-attacks", "account-recovery", "username-enumeration", "account-registration"]
phying_url: "https://phying.com/item/2325"
lang: en
---

# Preventing username enumeration

## Summary

Preventing username enumeration takes more than uniform errors: timing and HTML differences leak answers, and registration needs designs like app-chosen usernames to avoid revealing valid accounts.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2007-04-22T11:54:00Z
- **Original:** https://portswigger.net/blog/preventing-username-enumeration
- **Phying News:** https://phying.com/item/2325