Re: Pear::AUTH Checking for wrong password
| From: | Adam Ashley | Date: | Wed, 26 Apr 2006 23:53:34 +0000 |
| Subject: | Re: Pear::AUTH Checking for wrong password | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-23857@lists.php.net to get a copy of this message | ||
On Wed, 2006-04-26 at 10:03 -0500, Clements, Brent M (SAIC) wrote:
> Is there anyway to return if the password entered was wrong if the auth process fails?
>
Not directly. Auth specifically does not differentiate between incorrect
password and user account not existing as doing this would provide a
very easy vector for people to break in.
Telling them the password is wrong while seperately saying this username
is wrong is the same as telling them the username is correct keep trying
till you find a password.
So on failure Auth will return AUTH_WRONG_LOGIN meaning it could not
authenticate the username/password pair.
Adam Ashley
Attachment: [application/pgp-signature] This is a digitally signed message part signature.asc
Attachment: [application/pgp-signature] This is a digitally signed message part signature.asc