I would be nicer, that a user has been notified on the GUI and via email rather than just "Invalid login", when the account has been locked for "Lockout duration" seconds after login failure count has been reached or being disabled. In the current scenario, the user won't be able to know if the account has been locked or not after multiple failed login.
I would be nicer, that a user has been notified on the GUI and via email rather than just "Invalid login", when the account has been locked for "Lockout duration" seconds after login failure count has been reached or being disabled. In the current scenario, the user won't be able to know if the account has been locked or not after multiple failed login.