CY4: Identity and access: who gets in, and to what
Defending the login page
🎯You'll be able to
Stop a login page revealing which accounts exist, and slow down guessing without locking real users out for long.
🏠The everyday picture
A building's guard doesn't say "Mr Rao works on floor 4, but that's the wrong badge". They say "I can't let you in", whatever was wrong.
📘What it really is
-
Account enumeration: if the page says "no such user" for some IDs and "wrong password" for others, anyone can find which IDs exist. Use one message, such as "Wrong user ID or password."
-
Timing can leak too: if unknown users fail instantly but real ones take time to hash, the delay reveals them. Check a dummy hash for unknown users.
-
Guessing: one address trying many passwords on one account (brute force), or many passwords on many accounts (password spraying), or leaked email and password pairs from other sites (credential stuffing).
-
Defences: a temporary lock after a few failures (for example 5 in 15 minutes, for 15 minutes), rate limits per address, a check against breached passwords, and multi-factor login (Lesson 3).
-
Lockouts can be abused: permanent locks let anyone lock out a real user. Keep them short, and alert on repeated locks.
- Log every attempt with time, user, address and result. CY6 turns those logs into alerts.
📝A worked example
Input: the kit's starter login, which says "No such user" or "Wrong password".
Steps:
- Replace both with one message: "Wrong user ID or password."
- Count failures for the user in the last 15 minutes before checking the password. At 5 or more, refuse with "Too many attempts. Try again in 15 minutes." even if the password is right.
- Record every attempt in
login_attempts.
Expected output: unknown users and wrong passwords get the same message; the sixth try within 15 minutes is refused; after 15 minutes the right password works again.
🌍Where it's used
- Banking apps lock after a few wrong PINs and ask for extra checks.
- Cloud providers watch for many failed logins across accounts from one address.
- Password reset pages use the same rule: "If that account exists, we've sent a link."
📝Case scenario
A university's login page said "This student ID doesn't exist" for unknown IDs. Someone collected a full list of valid IDs and then tried common passwords on all of them. Changing to one message, plus short lockouts, made the same attempt far slower and visible.
🖱️Try it
Visit the "forgot password" page of a service you use and enter an address that has no account. Success: you can say whether the reply reveals that the account doesn't exist.
⚠️Common mistakes
- Different messages. Sign: "no such user". Fix: one message for every failure.
- Permanent lockouts. Sign: accounts locked until an admin unlocks them. Fix: short locks, plus alerts.
- Counting failures forever. Sign: a typo last month still counts. Fix: count within a time window.
🛠️For your project
Test 6 checks the single message, the lock after five failures, and that the lock ends after 15 minutes.
✅Quick check
Why should "no such user" and "wrong password" give the same message?
Show the answer
So nobody can find out which accounts exist.
What's the risk of a permanent lockout?
Show the answer
Anyone can lock out a real user on purpose.