Fixing user enumeration

Every single piece of information is vital to a malicious actor. Knowing if a user exists in a web application gives the attacker leverage to execute a more damaging and successful attack. Protect your ASP.NET Core web application by not providing this information by displaying general messages during authentication failures.

In this recipe, we will change the code that displays the not-so generic error message to prevent user enumeration attacks.

Getting ready

Using Visual Studio Code, open the sample Online Banking app folder at \Chapter03\user-emumeration\before\OnlineBankingApp.

Testing user enumeration

Follow these steps:

1. Navigate to Terminal | New Terminal in the menu or simply press Ctrl + Shift + ' in Visual Studio Code.
2. Type the following command in the Terminal to build and run the sample app:

   dotnet run

3. Open a browser and go to http://localhost:5000.
4. The browser will display the login page (see Figure 3.1).
...