Login + blank password + hitting enter bricks the instance for that particular user about uwazi

[konzz]

The issue is that the backend is "successfully" logging in with an empty password, and by that I mean it returns a 200.

The login process returns a false but not an error so after that, passport (the auth library) serializes a non-existing user, and every subsequently request goes through passport again to recover the user here:

uwazi/app/api/auth/passport_conf.js

Lines 29 to 41 in fcd8195

	passport.deserializeUser(async (serializeUser, done) => {
	try {
	const currentTenant = tenants.current().name;
	const [id, serializedTenant] = serializeUser.split('///');
	if (serializedTenant !== currentTenant) {
	return done(null, false);
	}
	const user = await users.getById(id, '-password', true);
	appContext.set('user', user);
	done(null, user);
	} catch (e) {
	done(e);
	}

This calls users.getById with an undefined id, and that's when Mongo throws the error because undefined is not a valid ObjectId

I think the critical solution should be not to allow login with those credentials.