Fix a Sign-In Handler: Validation, Errors and Account Enumeration

Asked at Okta · Coding Questions · Difficulty: Medium · Last asked Oct 6, 2026

A web service signs users in with a small handler that takes the request body, looks the user up and checks the password. The current handler works on the happy path but has five defects: it crashes on a malformed body, it lets an exception escape when the database or the password check fails, it tells an attacker which usernames exist, it returns the stored password hash to the client, and it returns the wrong status codes. Rewrite it so that every input gets a safe, correct response.

Loading the problem…