id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
24465	Failed logins are recorded as HTTP 200 instead of HTTP 403	Mark Litwintschik	nobody	"Attempting to login to the Django admin with an incorrect username and password combination logs the event as an `HTTP 200`:

`[10/Mar/2015 10:24:06] ""POST /admin/login/?next=/admin/ HTTP/1.0"" 200 2074`

I would expect that it would be recorded as a 403.

`django.contrib.admin.forms.AdminAuthenticationForm` raises a `forms.ValidationError` if the login is invalid but there is nothing out of the box that will record the response as HTTP 403."	Bug	closed	contrib.admin	1.7	Normal	invalid			Unreviewed	0	0	0	0	0	0