search

SFU-Blueprint / Pedals

Apache License 2.0
0 stars 0 forks source link

/api/change-access-code and /manage pages are potentially public #45

Open qvd808 opened 1 month ago

qvd808 commented 1 month ago

Problem

/api/change-access-code does not require authentication, meaning anyone understanding the API logic can potentially change the access code. Similarly, right now, we can access the /manage pages via URL instead of through /manage-login.

Note

We'll address this later, after completing the change access code functionality.

dangminhduc1101 commented 5 days ago

46 and #48 are resolved, so @qvd808 can take a look at this. This might be a good place to start: https://nextjs.org/docs/app/building-your-application/routing/middleware