ibm-garage-ref-storefront / auth-ms-openliberty Goto Github PK

I have inspected the HTTP response.

Tampering with the username / password gives
{
"error_description": "invalid_resource_owner_credential",
"error": "server_error"
}

Tampering with the client secret or id gives:
{
"error_description": "CWWKS1406E: The token request had an invalid client credential. The request URI was /oidc/endpoint/OP/token.",
"error": "invalid_client"
}

It is better to give out as little as information as possible to a would be attacker.

Would it be possible to change the error response message to "authentication failed"?

During tampering with the login I see:

[ERROR ] CWOAU0069E: The resource owner could not be verified. Either the resource owner: foo or password is incorrect.
[ERROR ] CWOAU0038E: The client could not be verified. Either the client ID: bluecomputeweb or client secret is incorrect.

It is best practice to log no personal data as such information can be misused.

Would it be possible to change the code to log that an invalid login attempt occurred from a specific IP address? In that case it would be possible to block that IP address in the WAF.