Creating more helpfull login errors

[peteruithoven]

We're noticing that failed logins attempts are a big source of confusion for users, especially when combining multiple providers (facebook, google, local).

Currently, when a user enters an invalid username/E-mail and/or password they simply get a "Invalid username or password" warning. We'd like to find a way to make that more helpfull.

Maybe check if an E-mail / login exists and check if the right provider is used.

Is there a way to do this with Superlogin?

The only way I can currently think of doing this is overring the login routes and adding some checks.
I could also partly do this client sided by using the GET /validate-email/ route, but that wouldn't give me information about providers and if might get unexpected results with invalid emails.

[ThonyFD]

I agree! and in additional is needed to develop a way to introduce Globalization (Messages in different languages) or/and error codes, I'm working in a Spanish app using SuperLogin but the error messages are a headache.

[micky2be]

@peteruithoven I understand where you are coming from but seems at bit too hacker friendly, if you know what I mean.
But as a user I totally agree 😄

@ThonyFD for error code and i18n we started a conversation here #99
I think all we need is someone to make a step forward and send a nice PR

[peteruithoven]

Because it would expose used usernames/emails? I understand that it would make it easier, but shouldn't the maxFailedLogins and lockoutTime measures basically make that infeasible?

[micky2be]

It will not make it infeasible. Only taking more time.
Also once email confirmed, one could hack the say email and try the recovery password.
Or run some search base on the email and hack an easier target to finally use same password in your "protected" website.
Also telling the provider used based on email will give some information to the hacker.
I'm going crazy paranoid now, but you got the idea.

You usually wanna avoid giving any information on failed login.

Again, as a user, I totally understand. Went to many service where I don't remember with which provider I logged in.

If something is done it should be configurable, if one wanna give more details from the server or not.