HTTP Status Code for username already exists when registering new account

I'd suggest returning error 409 Conflict:

The request could not be completed due to a conflict with the current state of the resource. This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request.


If your are concerned about privacy, regardless if the account was created or not make sure to respond the same way, and probably 204 or 202 are the most appropriated status code in this case.
To not confuse the user on the frontend you can display a generic message saying something like "You will receive a confirmation email on the next minutes if you don't have an account, if you don't receive the email try forget password".
Depending on how far you want to take things, you might want to create the account on a background process rather than in the main/request thread, otherwise attackers could analyze the response time of your endpoint and infer if the account was created or not based on the response time, this since the process of actually creating the account might take more time than just checking if it exists and returning.

Responding the same way in both scenarios is the only way to ensure an attacker can't figure out who is already registered in your system.

Tags:

Security

Http