passport
passport copied to clipboard
jaredhanson
Password with empty string causes failure w/out actually authenticating
When trying to login with the following credentials User: 'Admin' Pass: '' a new BadRequestError is being returned.
The authenticate fails in /passport-local/lib/passport-local/strategy.js Strategy.prototype.authenticate = function(req, options) { ... var password = lookup(req.body, this._passwordField) || lookup(req.query, this._passwordField);
In this example, the logical OR is doing password = '' || null With the way JavaScript works, the OR is returning the last value, which in this case is null
An empty string password should be allowed
