Hi @BNavin118206 (Community Member)​ 

Based on the information you give in the detail above, I can offer you a few recommendations:

1. Validate all inputs on every field in your form with regex if needed, but also be sure to do proper escaping and encoding to avoid malicious content to be entered.
2. Validation messages should not give the user an indication on which field they got wrong via username or password. Just give basic authentication message.
3. Captcha could also be added to the page to reduce the use of bots automating registrations or logins
4. You should set a limit on the number of login attempts and potentially lock the user out if exceeded.
5. Enforce strong password requirements when registering. (ie, do not allow username and passwd to be same, etc)
6. Mask your password field
7. With the forget password link, create a secure link to send the user and then have it expire after specific amount of time
8. Defend against Cross-Site-Request-Forgery in your site, some languages have things built in that can be used.
9. In addition, all the input validation that you do on the UI, should also be done on the back-end code or API whichever is used.
10. After adding all these things and you think you have everything taken care of, then test for things like X-Site Scripting, SQL-I, CSRF, etc.

This should give you a very good start to having a secure login page. Let me know if you have additional questions.

Thanks,

Jason