Yavook.de/node-fftcg
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

probing user names is still possible with "register", so doesn't matter

Browse source
This commit is contained in:
Jörn-Michael Miehe 2019-05-07 17:37:11 +02:00
parent 98a774a54d
commit 640cfe3b03
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
backend/db.coffee
View file

@ -82,8 +82,7 @@ class FFTCGDB
stmt.finalize()
if err
logger.warn "reg: FAIL db '#{err.code}' for '#{login}'"
# reduce attack surface, don't disclose user names
reject 'db' # user already exists
reject 'existence' # user already exists
else
logger.info "reg: OK '#{login}'"
@ -106,8 +105,7 @@ class FFTCGDB
# hash the password for timing attack reasons
bcrypt.hash password, saltRounds, (err, hash) ->
logger.debug "login: FAIL nonexistent '#{login}'"
# reduce attack surface, don't disclose user names
reject 'login' # user doesnt exist
reject 'existence' # user doesnt exist
else
bcrypt.compare password, row.pwdhash, (err, res) ->