This is interesting because ... why? And is SO a bug tracker these days? Why not link to your actual bug report at https://code.djangoproject.com/ticket/24465 h

This is interesting because ... why? And is SO a bug tracker these days? Why not link to your actual bug report at https://code.djangoproject.com/ticket/24465 https://code.djangoproject.com/ticket/24465 ? And reporting to the Django bug tracker, SO, and HN is excessive promotion for something so minor. Especially when 20 minutes after you filed the bug, and as I was typing this comment, it was closed, with the comment: > I can see your point, but the behaviour is correct and intentional. The 200 response means the same form is re-rendered, now including an error message. The user can edit their input and try again. A 403 response would cause the browser to display a much less friendly error, without offering a reasonable way for a user to correct their error. > Basically, login errors are handled the same way as any other form error, in the typical case: return a 200 response, display the form again, prefilled with any non-secret data the user already entered, and the appropriate error message. The user adjusts their input and submits the form again.