title: Why does Spring Security use default pre authentication checks?
body: <p>I've recently been implementing some security improvements in one of my employer's Spring-based Java applications, and I've overridden Spring Security's <code>AbstractUserDetailsAuthenticationProvider</code> class in order to do some extra processing around user authentication. During this process I realised that the <code>DefaultPreAuthenticationChecks</code> inner class performs user account checks prior to the authentication provider running through the <code>additionalAuthenticationChecks</code> method which does the validating of the password. If a user is disabled, expired or locked, an exception will be thrown, and thus the relevant messages will be displayed on the screen. To me, checking a user account and providing details of this account prior to successfully validating the password is a blatant security risk, as it could expose whether a user account exists or not. Does anyone know a good reason why Spring Security may have done things this way? Obviously I can just override the <code>DefaultPreAuthenticationChecks</code> class by creating my own dummy class with a <code>check</code> method that does nothing, but it's a shame that this has to be done in the first place.</p>
  
  <p>Thanks in advance.</p>
  
  <p>P.S. I found a question on a related note <a href="https://stackoverflow.com/questions/33969890/spring-security-lockedexception-is-thrown-instead-of-badcredentialsexception">here</a>, but nobody seemed to ask the question as to why this potential security flaw exists.</p>