4

My B2B web app's login form has an email and password field.

So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of message, which is "invalid email or password".

Should I verify the format of the submitted email address before making my login attempt ?

enter image description here

  • You might find this post useful – Okavango Feb 13 '15 at 9:50
  • Remember to validate emails with '+' in it. So many services are neglecting the possibility of having a '+' in the email address. eg: christian.paulson+b2bwebapp@gmail.com – Bluewater Feb 13 '15 at 15:06
  • Also, remember that emails don't need a dot in them. name@shoe is a valid email address. – Patrick M Sep 10 '15 at 15:25
4

Purely out of usability reasons you should always tell user what's wrong with the input. If the user doesn't know what's going wrong, he has to guess. Guessing on it's own is a a bad user experience because it requires effort. Additionally, the more incorrect guesses he does, the more frustrated he gets. So it's always a good practice to let user know what's wrong, as accurate and understandable as possible.

The only argument for why you shouldn't provide the exact reason why his login request is rejected is security.

Basic rule for login form securty

Theoretically you should not provide clear validation messages on any field on login form, because it reduces the total number of possible login attempts needed for a successful brute-force attack.

Will it really be more secure? Not much

In real world, if somebody tries to hack your application's login form by a brute-force attack, they don't use bots that just try characters 1 by 1, but rather a manual attack using software or a script written or customized exclusively for your application. That means the attacker can see the Adressse e-mail placeholder (or input name), and knows that any other format will fail, and adjusts his script to use only email address format. So, in practice you will only increase the total number brute-force attack attempts for "not-so-smart" bots, which is very little part of total, and carries relatively little risk. Of course it must be your personal decision where to find balance between security and usability in your own application, but in this case I would not sacrifice usability of letting user know what's wrong.

Note: Just in case anyone reading this doesn't know, you should only verify format (if it's already known, like in this case) and NEVER display messages like "This email address is not registered." etc.

  • 1
    What does your answer say about user experience? This isn't the security SE. – Rolf ツ Feb 13 '15 at 11:14
  • 1
    Good question Rolf, added more info on UX perspective. – Alph.Dev Feb 13 '15 at 12:53
1

Without looking at any security aspects I would say it's always best to validate formatting as much as you can in the page before going to the server (i.e. before your authentication request) and, as Alph.Dev says: Give the user clear feedback on what the problem is - if you're validating the email in page you should be able to tell them if it's not an email address OR if it's empty. Following that, if the authentication still fails, it might be worth considering a more verbose and friendly message such as "We couldn't find an account with those details. Please check and try again. If you have forgotten your login details please... [recovery process]"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.