API: /auth/login returns 400 when password is empty about traewelling HOT 2 CLOSED

400 Bad Request is the expected behaviour if you know the code (which is validating the input first and only then checks against the users table).

I would even argue that 400 fits better than 401 since it distinguishes a possible programming error by the API developer (in which no or an empty password is transferred) from a formally-correct request that accidentally contains bad user information.

from traewelling.

Now that i think about it both status codes are "correct" to use here, but 400 defiantly sound better with your reasoning.

from traewelling.