CODEWITHSUNDEEP
httphttp-status-codes
fanny
fanny

Reputation: 1441

what is appropriate status code for wrong email/username when user tries to reset password?

a simple use case - unlogged user tries to reset their password. they provide wrong email or username (but the format of the data is correct). should I return 400, 412 or 404?

Upvotes: 2

Views: 1001

Answers (2)

Sámal Rasmussen
Sámal Rasmussen

Reputation: 3515

It depends on whether the password reset resource is public or behind authentication.

The password reset resource that is publicly available should only ever respond with 200 in order to not leak information about which users exist or not. This prevents user enumeration attacks.

You should also make sure the public resource always takes the same amount of time to respond or includes a random delay, so that you don't leak the information through timing.

If the resource is behind authentication, then you may respond with informational errors like 404.

Upvotes: 3

Rithy Sam
Rithy Sam

Reputation: 41

It should be:

  • 200 for successfull
  • 401 for unauthorized

Upvotes: 0

Related Questions