User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
My B2B web app's login form has an email and password field.
So far, I'm only checking if the fields are empty. I then make my authentication request, if there's a problem I return only one kind of message, which is "invalid email or password".
Should I verify the format of the submitted email address before making my login attempt ?
Purely out of usability reasons you should always tell user what's wrong with the input. If the user doesn't know what's going wrong, he has to guess. Guessing on it's own is a a bad user experience because it requires effort. Additionally, the more incorrect guesses he does, the more frustrated he gets. So it's always a good practice to let user know what's wrong, as accurate and understandable as possible.
The only argument for why you shouldn't provide the exact reason why his login request is rejected is security.
Basic rule for login form securty
Theoretically you should not provide clear validation messages on any field on login form, because it reduces the total number of possible login attempts needed for a successful brute-force attack.
Will it really be more secure? Not much
In real world, if somebody tries to hack your application's login form by a brute-force attack, they don't use bots that just try characters 1 by 1, but rather a manual attack using software or a script written or customized exclusively for your application. That means the attacker can see the Adressse e-mail placeholder (or input name), and knows that any other format will fail, and adjusts his script to use only email address format. So, in practice you will only increase the total number brute-force attack attempts for "not-so-smart" bots, which is very little part of total, and carries relatively little risk. Of course it must be your personal decision where to find balance between security and usability in your own application, but in this case I would not sacrifice usability of letting user know what's wrong.
Note: Just in case anyone reading this doesn't know, you should only verify format (if it's already known, like in this case) and NEVER display messages like "This email address is not registered." etc.
Without looking at any security aspects I would say it's always best to validate formatting as much as you can in the page before going to the server (i.e. before your authentication request) and, as Alph.Dev says: Give the user clear feedback on what the problem is - if you're validating the email in page you should be able to tell them if it's not an email address OR if it's empty. Following that, if the authentication still fails, it might be worth considering a more verbose and friendly message such as "We couldn't find an account with those details. Please check and try again. If you have forgotten your login details please... [recovery process]"
