diff options
| -rw-r--r-- | lib/sockets.js | 4 | ||||
| -rw-r--r-- | routes/users.js | 14 |
2 files changed, 8 insertions, 10 deletions
diff --git a/lib/sockets.js b/lib/sockets.js index 7498db62..3bd0c2c2 100644 --- a/lib/sockets.js +++ b/lib/sockets.js @@ -92,8 +92,8 @@ app.register(async function(app) { try { if (!token || token === "null" || !jwt.decode(token)) return ws.close(code, `bad token ${token}`); - const username = jwt.decode(token).username; - if (!username) throw new Error("Invalid JWT token"); + const { username, uuid } = jwt.decode(token); + if (!(username || uuid)) throw new Error("Invalid JWT token"); if (!store.sockets[username]) store.sockets[username] = {}; const existing = Object.keys(store.sockets[username]); diff --git a/routes/users.js b/routes/users.js index 764d1f03..20b3bfee 100644 --- a/routes/users.js +++ b/routes/users.js @@ -342,7 +342,7 @@ app.post("/accounts", auth, async (req, res) => { let login = async (req, res) => { try { - const { params, sig, key } = req.body; + const { params, sig, key, password, username, token: twofa } = req.body; if (sig) { const { callback } = params; @@ -359,16 +359,14 @@ let login = async (req, res) => { return; } - let twofa = req.body.token; - - let user = await getUser(req.body.username); + let user = await getUser(username); if ( !user || (user.password && - !(await bcrypt.compare(req.body.password, user.password))) + !(await bcrypt.compare(password, user.password))) ) { - warn("invalid username or password attempt", req.body.username); + warn("invalid username or password attempt", username); return res.code(401).send({}); } @@ -382,11 +380,11 @@ let login = async (req, res) => { l( "login", - req.body.username, + username, req.headers["x-forwarded-for"] || req.connection.remoteAddress ); - let payload = { uuid: user.uuid }; + let payload = { username, uuid: user.uuid }; let token = jwt.sign(payload, config.jwt); res.cookie("token", token, { expires: new Date(Date.now() + 432000000) }); user.accounts = await user.getAccounts(); |