HTTP defines the status 401 Unauthorized for missing authentication, but this status only applies to HTTP authentication. What status should I return with a session cookie b
You can make use of a test condition and pass on the
Error code: 401.1-Logon failed. The logon attempt is unsuccessful, probably because of a user name or password that is not valid.
Which is specifically used for the incorrect password or mismatched user name and password. Hope this helps you.