Username/password validation should happen entirely server-side, with as little information as possible provided to the client

💯

It’s recommended practice to not even tell them which half of the username/password combination failed upon authentication failures.