So, we've got a fairly standard login page on a web application.
We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username is kept so the user doesn't need to enter it again.
The easiest way for us to do this is just put the username in the querystring, and bind that to the username input.
Are there any risks associated with this approach?
I've been thinking it through, and I can't think of how it could be exploited (except for a modified URL being sent to users that prepopulate with a different user's username, but even still, I can't see how that could be exploited further).