Username Enumeration

Username enumeration is an oracle: the app reveals whether an account exists. It rarely grants access by itself but multiplies the efficiency of stuffing, brute force, and phishing.

How it works

Leaks come from:

• Message differences: "user not found" vs "incorrect password".
• Status/format differences: different HTTP codes, redirects, or response lengths.
• Timing: a real user triggers a password hash (slow); a missing user returns fast.
• Side channels: registration ("email already taken"), password reset ("no such account"), and verbose API errors.

How to test

Compare responses for a known-valid vs known-invalid username across login, registration, and reset. Watch body length, status, redirects, and response time. A consistent distinguishable signal is the finding.

Impact

Lets attackers build a list of valid accounts to target precisely, lowering the cost of every follow-on attack.

Defenses

• Return identical responses (message, status, timing) regardless of account existence.
• Apply the same generic message across login, registration, and reset; rate-limit these endpoints.