generator-jhipster: Security: /authenticate endpoint returns information about users in the database

Overview of the feature request

Obfuscate the login response for accounts that do not exist in the database (Jhipster 7.9.3)

Motivation for or Use Case

Currently, when logging in with non-existing user, the API response is:

{
  "type" : "https://www.jhipster.tech/problem/problem-with-message",
  "title" : "Unauthorized",
  "status" : 401,
  "detail" : "User thisisanonexistinguser was not found in the database",
  "path" : "/api/authenticate",
  "message" : "error.http.401"
}

This creates an attack vector for the malicious user who can use this to enumerate users stored in the database.

Proposed solution

The solution would be to respond with a generic “invalid username or password” message.

Related issues or PR

Didn’t find similar issues

• [X ] Checking this box is mandatory (this is just to show you read everything)