Obfuscate password when login the login header (actualbudget#402)

laissonsilveira · Jul 29, 2024 · b4a620e · b4a620e
1 parent d3d9f70
commit b4a620e
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/src/app-account.js b/src/app-account.js
@@ -45,7 +45,9 @@ app.post('/login', (req, res) => {
   switch (loginMethod) {
     case 'header': {
       let headerVal = req.get('x-actual-password') || '';
-      console.debug('HEADER VALUE: ' + headerVal);
+      const obfuscated =
+        '*'.repeat(headerVal.length) || 'No password provided.';
+      console.debug('HEADER VALUE: ' + obfuscated);
       if (headerVal == '') {
         res.send({ status: 'error', reason: 'invalid-header' });
         return;

diff --git a/upcoming-release-notes/402.md b/upcoming-release-notes/402.md
@@ -0,0 +1,6 @@
+---
+category: Maintenance
+authors: [rodriguestiago0]
+---
+
+Obfuscate password when login the login header