During the security assessment of a new application, a tester attempts to log in to the application but receives the following message incorrect password for given username. Which of the following can

Redirecting to a support page upon incorrect password entry still implies that the username was recognized, potentially aiding username enumeration.

Completely disabling error messaging for authentication would provide a poor user experience as legitimate users would not know why their login failed.

The error message "incorrect password for given username" tells an attacker that the username is valid, confirming its existence. A better practice is to use generic error messages, such as "Invalid username or password," which do not reveal which part of the authentication attempt was incorrect, thereby preventing username enumeration and providing less helpful information to an attacker.

While multi-factor authentication or other advanced methods are stronger, eliminating password-based authentication entirely might not be feasible or desirable for all applications, and the question specifically addresses improving the existing error messaging.