Skip to content
This repository has been archived by the owner on Mar 22, 2022. It is now read-only.

authentication-local with Sequelize doesn't protect password on Sequelize error #691

Closed
tdolphin opened this issue Aug 1, 2018 · 2 comments

Comments

@tdolphin
Copy link

tdolphin commented Aug 1, 2018

Steps to reproduce

  1. feathers generate authentication
  2. use Sequelize (postgres)
  3. users.model.js has email field as unique
  4. create another user with same email
  5. Sequelize error sent in BadRequest 400 contains password.
  6. Add hook to error in users.hooks.js has no effect.
    error: { all: [protect('errors')], find: [], get: [], create: [], update: [], patch: [], remove: [] }
    Tried variation:
    protect('errors[0].instance.password')
    Tried using omit directly with no effect.

Expected behavior

protect/omit in error hooks should have effect

Actual behavior

protect/omit in error hooks not called.
throw feathersError; feathers-sequelize/lib/utils

System configuration

Module versions (especially the part that's not working):
authentication-local 1.2.1
feathers-sequelize 3.1.2

NodeJS version: 10.7

Operating System: windows 10

Browser Version: postman
sequelize_protecterror

Module Loader: npm

@daffl
Copy link
Member

daffl commented Aug 1, 2018

Similar to feathersjs-ecosystem/errors#115 - basically feathers-sequelzize should not really pass through - or clean up - any of those errors.

Additionally, it is true, the protect hook in https://github.com/feathersjs/authentication-local/blob/master/lib/hooks/protect.js should also do this for context.error

@daffl
Copy link
Member

daffl commented May 8, 2019

This has been done in the latest feathers-sequelize.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants