Password with empty string causes failure w/out actually authenticating #166
Description
When trying to login with the following credentials
User: 'Admin'
Pass: ''
a new BadRequestError is being returned.
The authenticate fails in /passport-local/lib/passport-local/strategy.js
Strategy.prototype.authenticate = function(req, options) { ...
var password = lookup(req.body, this._passwordField) || lookup(req.query, this._passwordField);
In this example, the logical OR is doing
password = '' || null
With the way JavaScript works, the OR is returning the last value, which in this case is null
An empty string password should be allowed