Show your headers.
#Request returns to homepage
grim galleon
Also. You don’t “log in” to APIs.
translation error
frigid peak
I also wouldn’t be putting so much validation around the email and password fields, as you’re just leaking whether an email actually exists in the database, and the minimum and maximum length of passwords, which just means an attacker can narrow their efforts.
grim galleon
Show your headers.
What's the directory?
grim galleon
I also wouldn’t be putting so much validation around the email and password fiel...
ok, but these evaluations do not check with the database, they only ask for a password and the minimum number of characters
frigid peak
ok, but these evaluations do not check with the database, they only ask for a pa...
Yes, and now an attacker can go “Cool, I just need to bother with trying to crack passwords between 8 and 50 characters.”
grim galleon
What's the directory?
passwords over 8 characters, with number, lowercase and uppercase letter and a special character take years to be cracked.
years is an exaggeration but days
and if I increase it to 12 characters, this becomes impossible
