fix: LocalStrategy authenticates without username (#1560)

#1559
feathersjs · Sep 16, 2019 · 2b258fd · 2b258fd
1 parent eae036b
commit 2b258fd
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/packages/authentication-local/src/strategy.ts b/packages/authentication-local/src/strategy.ts
@@ -45,6 +45,10 @@ export class LocalStrategy extends AuthenticationBaseStrategy {
 
   async findEntity (username: string, params: Params) {
     const { entityUsernameField, service, errorMessage } = this.configuration;
+    if (!username) { // don't query for users without any condition set.
+      throw new NotAuthenticated(errorMessage);
+    }
+
     const query = await this.getEntityQuery({
       [entityUsernameField]: username
     }, params);