Why does owasp recommend using case insensitive logins ?

Make sure your usernames/user IDs are case-insensitive. User 'smith' and user 'Smith' should be the same user.

What's the security aspect of it?


I can see two main aspects:

  1. Convenience

    Users with mobile keyboards with auto-capitalization enabled will not have to change the first letter to lower case before submitting the form, and that leads to a better user experience.

  2. Makes impersonation harder

    If Smith and smith are seem as different users, and you allow users to communicate with each other, someone can create "clones" of the current accounts and mislead other users.

  • There are some applications that make authentication and account creation behave differently. Authentication is case sensitive, but account creation is not, so as to protect against your second point. I concur with your first point though. When you say 'main' aspects, do you have other smaller points in mind? – bobif Dec 4 '20 at 13:30
  • You can force lower-case when the user creates an account and when they try to login, so no matter what the user does, the account will always be lowercase. – ThoriumBR Dec 4 '20 at 13:35

Many users use Windows and in Windows, the most names are not case sensitive. So if you want a nice user experience you should avoid case sensitive names.

But Unix systems have used case sensitive names for 50 years with no problem at all, because their users had to know that smith, Smith and SMITH are 3 different names, either for files or for users.

If the names are given by an administrator, it does not matter whether they are or not case sensitive: no sane administrator would give smith to John Smith and Smith to Bob Evil. But when you have a system in which users can register automatically, it can be important to prevent Bob Evil to create a Smith account. If you don't, you would fail your professional duty of good practices and help Bob to impersonate John.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.