From dacd67f2dae7db7e8717f3c67c89101926922fd1 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan.tuomi@eficode.com>
Date: Wed, 5 Feb 2020 20:09:39 +0200
Subject: Implemented better validation

---
 backend/src/authn.js | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

(limited to 'backend/src/authn.js')

diff --git a/backend/src/authn.js b/backend/src/authn.js
index 40c7da8..8c12396 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -79,12 +79,27 @@ const registerRoute = async (req, res) => {
     });
   }
 
+  let validationErrors = [];
+  const usernameMinLength = 5;
+  const usernameMaxLength = 20;
+
+  if (username.length < usernameMinLength) {
+    validationErrors.push(`Username must be at least ${usernameMinLength} characters long.`);
+  }
+
+  if (username.length > usernameMaxLength) {
+    validationErrors.push(`Username must be at most ${usernameMaxLength} characters long.`);
+  }
+
   const owaspPwTestResults = owaspPw.test(password);
   if (!owaspPwTestResults.strong) {
+    validationErrors = validationErrors.concat(owaspPwTestResults.errors);
+  }
+
+  if (validationErrors.length > 0) {
     res.status(400);
     return res.json({
-      error: 'Password not strong enough',
-      errors: owaspPwTestResults.errors,
+      errors: validationErrors,
     });
   }
 
@@ -113,23 +128,25 @@ const loginRoute = async (req, res) => {
   }
 
   const user = await db('users').where({ username }).first();
+  const salt = user.salt;
+  const pwHash = sha512(salt + password);
 
-  if (user) {
-    const sessionToken = shortid.generate();
-    const sessionTokenHash = sha512(user.salt + sessionToken);
+  if (!user || pwHash !== user.password) {
+    res.status(400);
+    res.json({
+      error: 'Wrong username or password',
+    });
+  }
 
-    await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
+  const sessionToken = shortid.generate();
+  const sessionTokenHash = sha512(user.salt + sessionToken);
 
-    res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember, isLogout: false }));
+  await db('tokens').insert({ user_id: user.id, type: 'session', value: sessionTokenHash });
 
-    return res.json({
-      username,
-    });
-  }
+  res.set('Set-Cookie', buildSessionCookie({ username, sessionToken, remember, isLogout: false }));
 
-  res.status(403);
-  res.json({
-    error: 'Wrong username or password',
+  return res.json({
+    username,
   });
 };
 
-- 
cgit v1.3