m5c / lobbyservice

Generic board game functionality (Authentication, User-Management, Session-Management), accessible as a RESTful service.

Hi there 👋

I'm a professor in Software Engineering Research.
My main interests are tools for RESTful Services, DevOps, Security Protocols, API Security, and all the empirical methodology needed to understand their effects on software engineers. That is: real, measurable effects on humans, and the software produced.

You can download my most important articles, video tutorials and teaching material on my professional website.
For a full record of publications and co-authorship, see my Google Scholar page.

lobbyservice's Issues

Able to create user with no special characters in password

Hello,

Despite password policy of the LS, I was able to successfully create a user with the following JSON body:

{
    "name": "arman1",
    "password": "ABCabc123456",
    "preferredColour": "01FFFF",
    "role": "ROLE_PLAYER"
}

This returns status code 200 OK despite not adhering to password policy.

"+" is being removed the the access token of users whenever we send a request with it

Whenever we post a request with an access token with the character + it is removed and sends an error of invalid_token.
This only happens when it is sent as a query string.

Example request in python:

token = "o5dzRnobJ3fIC666Ibg79+QqnO8="
users = requests.get('YOUR_URL/api/users?access_token={}'.format(token))

Typo in api.md

IN:
https://github.com/kartoffelquadrat/LobbyService/blob/master/markdown/api.md#authentication

the example for:

/oauth/token
PUT

should be POST (like the example with curl)

/api/users returns preferredColour whereas /api/users/{user} returns preferredColor

Hello,

When running GET on api/users to get all the users in the LS the attribute is spelled as preferredColour whereas when running a GET on a specific user to get info on that one user, the attribute is spelled as preferredColor.

This causes issues when trying to save the User information as an object and to reconcile the two requests.