From dacd67f2dae7db7e8717f3c67c89101926922fd1 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan.tuomi@eficode.com>
Date: Wed, 5 Feb 2020 20:09:39 +0200
Subject: Implemented better validation

---
 backend/src/authn.js  | 45 +++++++++++++++++++++++++++++++--------------
 frontend/src/Login.js |  8 ++++----
 2 files changed, 35 insertions(+), 18 deletions(-)

diff --git a/backend/src/authn.js b/backend/src/authn.js
index 40c7da8..8c12396 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -79,12 +79,27 @@ const registerRoute = async (req, res) => {
     });
   }
 
+  let validationErrors = [];
+  const usernameMinLength = 5;
+  const usernameMaxLength = 20;
+
+  if (username.length < usernameMinLength) {
+    validationErrors.push(`Username must be at least ${usernameMinLength} characters long.`);
+  }
+
+  if (username.length > usernameMaxLength) {
+    validationErrors.push(`Username must be at most ${usernameMaxLength} characters long.`);
+  }
+
   const owaspPwTestResults = owaspPw.test(password);
   if (!owaspPwTestResults.strong) {
+    validationErrors = validationErrors.concat(owaspPwTestResults.errors);
+  }
+
+  if (validationErrors.length > 0) {
     res.status(400);
     return res.json({
-      error: 'Password not strong enough',
-      errors: owaspPwTestResults.errors,
+      errors: validationErrors,
     });
   }
 
@@ -113,23 +128,25 @@ const loginRoute = async (req, res) => {
   }
 
   const user = await db('users').where({ username }).first();
+  const salt = user.salt;
+  const pwHash = sha512(salt + password);
 
-  if (user) {
-    const sessionToken = shortid.generate();
-    const sessionTokenHash = sha512(user.salt + sessionToken);
+  if (!user || pwHash !== user.password) {
+    res.status(400);
+    res.json({
+      error: 'Wrong username or password',
+    });
+  }
 
-    await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
+  const sessionToken = shortid.generate();
+  const sessionTokenHash = sha512(user.salt + sessionToken);
 
-    res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember, isLogout: false }));
+  await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
 
-    return res.json({
-      username,
-    });
-  }
+  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember, isLogout: false }));
 
-  res.status(403);
-  res.json({
-    error: 'Wrong username or password',
+  return res.json({
+    username,
   });
 };
 
diff --git a/frontend/src/Login.js b/frontend/src/Login.js
index a251216..cd91e91 100644
--- a/frontend/src/Login.js
+++ b/frontend/src/Login.js
@@ -7,7 +7,7 @@ import userState from './UserState';
 
 const Login = () => {
   const { register, handleSubmit } = useForm();
-  const [ loginError, setLoginError ] = useState(null);
+  const [ data, setData ] = useState({});
 
   const onSubmit = async data => {
     try {
@@ -18,10 +18,10 @@ const Login = () => {
       navigate('/');
     } catch (err) {
       if (err.response && err.response.data) {
-        setLoginError(err.response.data.error);
+        setData({ error: err.response.data.error });
       } else {
         console.error(err);
-        setLoginError('Unknown error occurred. See console for details.');
+        setData({ error: 'Unknown error occurred. See console for details.' });
       }
     }
   };
@@ -38,7 +38,7 @@ const Login = () => {
       <button className="button" type="submit">
         Log in
       </button>
-      <div className="error">{loginError}</div>
+      <div className="error">{data.error}</div>
       <div>
         No account? Register <Link to="/register">here</Link>.
       </div>
-- 
cgit v1.3