0

I am working on a node.js application that allows users to sign up for accounts using social media. When they do this an entry is created in our database with their email address, and a blank password.

When I saw this I became concerned that someone could simply supply an email address and a blank password to log in as anyone who had a social media account. After some quick testing it appears that there is a line in the authentication code that throws an error if there is a zero length password. The line is below:

 if (!username || !password) { ...

The only thing that I could think of to try and trip this up was to pass a URL encoded DEL character in (%7F) but this didn't bypass either.

I'm just curious if I am safe with the above or if there is some character that could be passed in that would get past the check above?

3

The test you have:

if (!username || !password)

Checks if either username and password values are javascript falsey values. A falsey value in javascript is any one of these : null, undefined, 0, false, NaN or an empty string.

An empty string in javascript is a zero length string so if it has at least one character in it (any character will suffice), then it is not an empty string.


So, if because of the way your code is structured, you know that both username and password will always be strings, then the above code is just checking to see if either of them are empty strings.

There is no character that could be in those strings that would pass the above test. One of the strings must be completely empty (zero length) to pass that test.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.