New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] Unverified User login #48

Open

Drewbi opened this issue Mar 7, 2022 · 0 comments

Labels

API hard problem

Contributor

Drewbi commented Mar 7, 2022

Problem
Unverified users can log in using an empty password

Where/When
Api authentication logic

Desired behavior

If the verified field on the user object is false, all logins should be blocked.
When an unverified user has been created, their password is set to "" which is then salted and hashed. This is potentially unwanted behavior.

Screenshots
Logging in with an empty password

Unverified user created with "" as their password (hashed value)

Drewbi added API problem hard labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment