You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Current, the login endpoint returns a 404 not found code when the supplied email does not correspond to a user account and a 401 unauthorized code when the email corresponds to a user account but the password does not match the user's password. This is a security issue because it could be used to guess users' email addresses. The server should instead respond with a 401 if the email and password provided don't match an existing user account.
Affected Functionality
The login endpoint would need to be changed. This would be a breaking API change so the frontend would need to be notified of this too.
Current, the login endpoint returns a 404 not found code when the supplied email does not correspond to a user account and a 401 unauthorized code when the email corresponds to a user account but the password does not match the user's password. This is a security issue because it could be used to guess users' email addresses. The server should instead respond with a 401 if the email and password provided don't match an existing user account.
Affected Functionality
The login endpoint would need to be changed. This would be a breaking API change so the frontend would need to be notified of this too.
Other Relevant Issues
#177
The text was updated successfully, but these errors were encountered: