Post by shawnw on Oct 5, 2023 9:49:41 GMT
Hi,
I have some questions about "Account Locked". I'm not sure about the appropriate behavior.
Case 1: If a locked account attempts to log in with an incorrect password:
Should Redfish return a 401?
Case 2: If a locked account attempts to log in with the correct password:
Should Redfish return a 403? Or, would it be more secure to return a 401 to avoid revealing that the user exists?
Many Thanks,
Shawn
I have some questions about "Account Locked". I'm not sure about the appropriate behavior.
Case 1: If a locked account attempts to log in with an incorrect password:
Should Redfish return a 401?
Case 2: If a locked account attempts to log in with the correct password:
Should Redfish return a 403? Or, would it be more secure to return a 401 to avoid revealing that the user exists?
Many Thanks,
Shawn
