26

A client sends the following to POST /account/register

{
  "username": "user123",
  "password": "pa55w0rd"
}

The server attempts to create the new account but finds that the username is already taken.

What should the most appropriate HTTP status code response be?

I'm thinking 409 Conflict however that means the client is then aware that the username exists, which might be a security issue? Or is it simply a case of visibility based on the type of site so depends on the situation?

3
  • 2
    Since you are using username there is no other way around it, luckly an username doesn't reveal to much information like an email. Regarding the HTTP status code, I think that sending an 200 with an error message/code is good enough. Why? Because you received the request, understood what the client said, processed it (validated that the username already existed) and could answer ("hey! that username is already taken!"). Commented Oct 27, 2014 at 13:50
  • 1
    @JhulianoMoreno HTTP services should not respond with 200 OK if the request was not fulfilled. It's still an error. 200 OK tells a user "registration was successful" any 4xx code tells a client it's not.
    – Evert
    Commented Nov 16, 2018 at 18:21
  • @Evert pretty old comment and I totally agree with you that my old comment was wrong :) posted a response with what I think is the most appropriated way of doing this, since none of the answer seemed to fulfill the "privacy" concern. Commented Jan 28, 2019 at 11:24

4 Answers 4

34

I'd suggest returning error 409 Conflict:

The request could not be completed due to a conflict with the current state of the resource. This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request.

11

If your are concerned about privacy, regardless if the account was created or not make sure to respond the same way, and probably 204 or 202 are the most appropriated status code in this case.
To not confuse the user on the frontend you can display a generic message saying something like "You will receive a confirmation email on the next minutes if you don't have an account, if you don't receive the email try forget password".
Depending on how far you want to take things, you might want to create the account on a background process rather than in the main/request thread, otherwise attackers could analyze the response time of your endpoint and infer if the account was created or not based on the response time, this since the process of actually creating the account might take more time than just checking if it exists and returning.

Responding the same way in both scenarios is the only way to ensure an attacker can't figure out who is already registered in your system.

0

Doesn't seem there's one. Maybe 406 Not Acceptable? http://en.wikipedia.org/wiki/List_of_HTTP_status_codes

0

For user already exists 403 seemed perfect according to wikipedia https://en.wikipedia.org/wiki/HTTP_403

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.