satishbabariya / nodejs-boilerplate Goto Github PK

During sign up, you should not specify whether an account exists or not.

if (error.name === 'MongoError' && error.code === 11000) {
    // Duplicate username
    throw new Error('User already exist!');
}

Similarly, you should not specify whether a user exists during login vs. password incorrect. Both are leaking potentially sensitive information whether a user account exists.

A better implementation for sign-in would be to say that the credentials are invalid. Similarly, for registering, it would be to just say check your email regardless of whether you send an email for confirmation.

@satishbabariya

I am currently distributing TypeScript Express Starter as open source.
However, I am developing typeorm with a new template., and it seems to be a good resource.

We look forward to your good repo. :-D