gray-mueller / gray-mueller/food-delivery-app-with-source-code
Login authentication security issue
Open
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Login endpoints where I can login as any user without a password just with type: "google"
Contributor guide
Research direction
Start by locating the login endpoint that handles type: "google" and trace how it selects the user. Reproduce the reported login behavior in a safe local environment, then inspect the related authentication checks. Done means the endpoint no longer authenticates an arbitrary user without validating the required credentials or Google identity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100