3 ms·

They could. But how would they show the users their desired contents after login?

• notatoad 11y ago
  Doesn't matter, they've already gotten your password at that point. They can just say "login failed" and redirect you to the real login page