I am responsible for a website and I am questioning the logic of some 'Industry standard' policies that I have been asked to comply with.
When a user logs into the website, they get a message to tell them the login details are incorrect, but we do not specify if it is the username or the password that is incorrect.
If the user then realizes they have forgotten their password (should have used a password manager), they can click on the forgotten password link and enter their email address and press enter. They are then shown a message telling them that if they have an account, the account has been locked and that a password reset email has been sent to their email account.
So far, there is no leakage of information about which credential is incorrect or whether an account exists for the email provided.
To improve the user's experience, I suggested that if the user clicks on the forgotten password link, if it is available in the login field, we should copy the email address into the email address field in the forgotten password page.
However, I have been told this is against 'Industry Standards', even though nobody can show me anything to back this up!
I understand that simply adding it to the URL would be bad, as it would allow people to cycle through email addresses and lock people's accounts out, causing inconvenience to the users.
What security vulnerability, if any, would make this bad practice?
An update for any new readers.
There have been some great answers on here and I am grateful for all of the input.
The process had a flaw, in the lockout on forgotten password and this will be amended. The message when a locked out account still gives the
email address or password incorrect message, so the user would not know the email address was a valid one.
firstname.lastname@example.org of the whole address. Why they do this is covered in the answers, but I didn't see anyone point out this approach as a standard or convention.