I've got a login page with a form where they can input their account's email address and password.
I'm doing the following things before even attempting to authenticate a user:
Validating the email address for correct format.
Validating the password for not being empty.
If any of these are invalid, I report back with the validation errors like:
- "You did not enter an email address." and/or "You must enter a password.".
It's also susceptible to timing attacks since password verifying is not attempted when there are errors.
Would it be safer to just accept any input and just report back with a generic "Login failed." error?