login and forgot password feedback for users valid with OWASP recommedations

[Marcin Federowicz]

Hi @KalleHallden I know that login feedback for users were raised in that PR
but for seucrity reasons i think will be good to use OWASP recommendations for that kind of labels (ie: dont inform user that used credentials match/dont match to existing accout)

source of correct and incorrect responses

1. https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
2. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#incorrect-and-correct-response-examples

[Sujan Pradhan]

Great. I guess we can change Login error responses to "Login failed; Invalid email or password."

But for Account Creation,

As of now, we dont have any verification email sent to user mail, so do we have any suggestion for that?

[Marcin Federowicz]

Hmm, it is not good to give users access to system without veryfication of email account. I know that application is in early development stage, but maybe it is good point to think about it :)

[kalle hallden]

Yeah I think this is a good thing to correct as well.

[kalle hallden]

@all-contributors please add @suzanpradhan for project management and ideas & planning

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Thank you for your contributions.