When attempting to login, the error messages should not leak information about whether a username is valid.

This also means the error message is more appropriate if somebody tries to login with somebody else's username and their password.

2 files changed, 7 insertions, 4 deletions

diff --git a/users/config/locales/en.yml b/users/config/locales/en.yml
index 1b2789e..c1512eb 100644
--- a/users/config/locales/en.yml
+++ b/users/config/locales/en.yml
@@ -7,6 +7,7 @@ en:
   login_message: "Please login with your account."
   wrong_password: "wrong password"
   user_not_found: "could not be found"
+  invalid_user_pass: "Not a valid username/password combination"
   update_login_and_password: "Update Login and Password"
   cancel_account: "Cancel your account"
   remove_account: "Remove Account"
diff --git a/users/lib/warden/strategies/secure_remote_password.rb b/users/lib/warden/strategies/secure_remote_password.rb
index 483336d..5032914 100644
--- a/users/lib/warden/strategies/secure_remote_password.rb
+++ b/users/lib/warden/strategies/secure_remote_password.rb
@@ -26,9 +26,11 @@ module Warden
 
       def validate!
         client = session[:handshake].authenticate(params['client_auth'].hex)
-        client ?
-          success!(User.find_by_login(client.username)) :
-          fail!(:password => "wrong_password")
+        if client
+          success!(User.find_by_login(client.username))
+        else
+          fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
+        end
       end
 
       def initialize!
@@ -39,7 +41,7 @@ module Warden
           session[:handshake] = SRP::Session.new(client, params['A'].hex)
           custom! json_response(session[:handshake])
         else
-          fail! :login => "user_not_found"
+          fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
         end
       end