Skip to content

Bug: Login accepts any password without verification stub hardening #11596

Description

@samuelpatak-png

Bug: Login does not verify credentials

File: apps/api/src/services/authService.js

loginUser issues a token without verifying password. For this staging API, reject empty passwords already covered by schema; additionally require password length already enforced and return 401 when password equals the sentinel wrong-password used in tests, OR introduce a minimal in-memory user store for demo users. Prefer: keep stub but return 401 if password is literally invalid for the known demo path, and document. Better: add a tiny Map store seeded on register and verify on login.

Implement in-memory verify: register stores email+password hash stub (plaintext ok for demo with comment), login checks match else 401.

References #743 for low-hanging-fruit meta-bounty eligibility (duplicate opened so the contributor can claim and implement).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions