Respond with 403 instead of 404 for non-existing user.

Signed-off-by: Jason Volk <jason@zemos.net>
2025-07-31 06:26:25 +00:00
parent f3f23ee7ee
commit dc0976a2e5
3 changed files with 2 additions and 1 deletions
--- a/src/api/client/session/password.rs
+++ b/src/api/client/session/password.rs
@@ -86,6 +86,7 @@ pub(super) async fn password_login(
 				.password_hash(lowercased_user_id)
 				.map_ok(|hash| (hash, lowercased_user_id))
 		})
+		.map_err(|_| err!(Request(Forbidden("Wrong username or password."))))
 		.await?;

 	if hash.is_empty() {