Better error message on unauthorized login attempts. about nativeauthenticator HOT 2 CLOSED

Some notes for future me:

• The error message comes from the upstream JupyterHub Login Manager, that will probably have to be overridden.
• It might be worth another think if this exposes (the correctness of) login credentials, maybe check for authorization before checking correctness.

from nativeauthenticator.

It might be worth another think if this exposes (the correctness of) login credentials, maybe check for authorization before checking correctness.

I've decided that this is a negligible concern, since this only has any effect if a would-be attacker knows or correctly guesses the user's password. Normally, that would just lead to login, which is equally unfortunate. If this is too risky for anyone, they can default to the n-attempts-to-ban mechanic.

from nativeauthenticator.