A client sends the following to POST /account/register
{
"username": "user123",
"password": "pa55w0rd"
}
The server attempts to create the new account but finds that the username is already taken.
What should the most appropriate HTTP status code response be?
I'm thinking 409 Conflict
however that means the client is then aware that the username exists, which might be a security issue? Or is it simply a case of visibility based on the type of site so depends on the situation?