Agent WranglersAbuse and limits Required
Give the same answer for known and unknown accounts
Login, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
How to do it
Use one message for a wrong email and a wrong password. On reset, always give the same message. Keep the response time the same too, for example by hashing a dummy password when the user is missing.
Example
Good: If an account exists for this address, we sent a reset link.
Bad: No account found for jo@example.com.How to check
Ask for a reset for a test account and for a made-up address. The status, body and time are the same within a few milliseconds.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration.