In Production mode, responses should not leak information

[DougReeder]

When NODE_ENV=production is set in the environment

• "Username not found" -> "The user name and password don't match"
• "Incorrect password" -> "The user name and password don't match"
• error.message should never be displayed, only an appropriate message or "An error occurred".

Other responses might need to be changed as well.

The log must still contain the details we hide from end users.

[andersonjoseph]

I would like to work on this. I took a look at the code and, currently, the only error that auth.html expects is a 401 Unauthorized. Since the log must still contain the error details, we could change the response only on the auth view when process.env.DEBUG is set.

   <% if (typeof error !== 'undefined') { %>
-    <p class="error"><%= error %></p>
+    <% if (process.env.DEBUG) { %>
+      <p class="error"><%= error %></p>
+    <% } else { %>
+      <p class="error">Login failed - Incorrect username or password</p>
+    <% } %>
   <% } %>

Let me know if you have any comments so I can make a PR or if you already have a plan for this =)

[DougReeder]

That's very close to what I'm thinking! I think we should use NODE_ENV here rather than DEBUG.

We should also change line 14 of contrib/systemd/armadietto.service to Environment=NODE_ENV=production