Three options for Exceptions ... opinions?

Question

I've got a method login() which has many reasons why it might fail. As I see it I've got three options, and I'm interested in opinions on them, or any additional options ...
1) public void login(String userName, String password) throws ApplicationException, LoginException, InvalidPasswordException, InvalidUsernameException, UserDeceasedException, UserNotFoundException, AdminUserLoginException {}
Where LoginException extends ApplicationException, and all the other exceptions extend LoginException
This means that clients using the method can catch the exact exception they're interested in:
try
user.login(uname, pword);
catch (InvalidPasswordException e)
// process for invalid password
catch (InvalidUsernameException e)
// process for invalid username
catch ... etc
2) public void login(String pUserName, String pPassword) throws HouseApplicationException, LoginException {}
Where LoginException extends ApplicationException
This means that clients using the method wanting to know what went wrong need to do instanceof:
try
user.login(uname, pword);
catch (LoginException e)
if (e instanceof InvalidPasswordException)
// process for invalid password
else if (e instanceof InvalidUsernameException)
// process for invalid username
else if ...
3) public void login(String pUserName, String pPassword) throws HouseApplicationException, LoginException {}
Where LoginException extends ApplicationException
And LoginException has an overloaded constructor that takes a Login Exception Type (set as constants in the Login class):
public LoginException(String message, int loginExceptionType)
And a getter on this exception type attribute.
So when throwing the exception, the method would call:
throw new LoginException("Users password is incorrect", Login.INVALID_PASSWORD);
This means that the clients using the method need to check this as follows:
try
user.login(uname, pword);
catch (LoginException e)
if (e.getLoginExceptionType() == Login.INVALID_PASSWORD)
// process for invalid password
else if (e.getLoginExceptionType() == Login.INVALID_USERNAME)
// process for invalid username
else if ...
I hate option 1 because the method declaration looks horrible, and if you add another exception, and you continue with the "paradigm", you'd have to declare the new exception as also being thrown, and alter all the clients to deal with it.
I'm don't have any opinion as to whether option 2 is better than option 3 or vice versa.
I'm interested what others think ...
Thankyou!
k

Answer 1

I've got a method login() which has many reasons why
it might fail. Wrong design. Wrong security handling.
Exceptions are for handling abnormal conditions. You are using them to handle normal conditions.
An abnormal condition would be 'the database is gone'. A normal condition is wrong user/password. Your method should be returning a variable that indicates the state of the login.
You also have a security problem in that you are specifically handling user and password seperately. They should be handled as a unit. You should never tell anyone that the 'user' is wrong or the 'password' is wrong. Doing so makes it easier to break the security. You just tell them that the login failed.