By the way ASP.NET by default generates code for you does POST/redirect/GET on success, but does not if there was an error, such as a typo. That's still disclos

By the way ASP.NET by default generates code for you does POST/redirect/GET on success, but does not if there was an error, such as a typo. That's still disclosing lots of information, imo. [HttpPost] [AllowAnonymous] [ValidateAntiForgeryToken] public ActionResult Login(LoginModel model, string returnUrl) { if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, persistCookie: model.RememberMe)) { return RedirectToLocal(returnUrl); } // If we got this far, something failed, redisplay form ModelState.AddModelError("", "The user name or password provided is incorrect."); return View(model); } How is this problem handled in other frameworks?