When attempting to login, the error messages should not leak information about whether a username is valid.

This also means the error message is more appropriate if somebody tries to login with somebody else's username and their password.

1 files changed, 6 insertions, 4 deletions

diff --git a/users/lib/warden/strategies/secure_remote_password.rb b/users/lib/warden/strategies/secure_remote_password.rb
index 483336d..5032914 100644
--- a/users/lib/warden/strategies/secure_remote_password.rb
+++ b/users/lib/warden/strategies/secure_remote_password.rb
@@ -26,9 +26,11 @@ module Warden
 
       def validate!
         client = session[:handshake].authenticate(params['client_auth'].hex)
-        client ?
-          success!(User.find_by_login(client.username)) :
-          fail!(:password => "wrong_password")
+        if client
+          success!(User.find_by_login(client.username))
+        else
+          fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
+        end
       end
 
       def initialize!
@@ -39,7 +41,7 @@ module Warden
           session[:handshake] = SRP::Session.new(client, params['A'].hex)
           custom! json_response(session[:handshake])
         else
-          fail! :login => "user_not_found"
+          fail!({:login => "invalid_user_pass", :password => "invalid_user_pass"})
         end
       end