Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Incorrect Password Algorithm Results in Internal Server Error instead of 401 Unauthorized #151

Open
r-richardson opened this issue Aug 18, 2023 · 0 comments
Open

Incorrect Password Algorithm Results in Internal Server Error instead of 401 Unauthorized #151

r-richardson opened this issue Aug 18, 2023 · 0 comments
Labels
good first issue Good for newcomers hacktoberfest Suitable Hacktoberfest contribution

Comments

@r-richardson
Copy link
Contributor

Description

Currently, when a user uses an incorrect password algorithm during account creation and attempts to log in, an internal server error (HTTP 500) is triggered. This exposes a security risk by divulging internal system details.

Steps to reproduce

  1. Create new user with hash value generated by password algorithm other than bcrypt.
  2. Try to log in using created user's credentials.
  3. Observe the response status code.

Expected behavior

401 status code response (Unauthorized) to failed login attempts
@crazyscientist crazyscientist added the good first issue Good for newcomers label Sep 25, 2023
@crazyscientist crazyscientist added the hacktoberfest Suitable Hacktoberfest contribution label Oct 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
good first issue Good for newcomers hacktoberfest Suitable Hacktoberfest contribution
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@crazyscientist @r-richardson