Account Enumeration

[Wilsonator123]

Following guidelines we should implement methods to prevent Account Enumeration. (Here is a list of some, please add more if needed)

• [ ] MFA for logins
• [ ] Remove any default accounts
• [x] Weak password checking
• [x] Follow NIST password guidelines
• [x] Same message responses for all outcomes
• [x] Limit / Delay failed attempts
• [x] High entropy session IDs

[Wilsonator123]

https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html