Getting access to secured API, even if logged out

auth0-blog / angular2-authentication-sample

This is a sample that shows how to add authentication to an Angular 2 (ng2) app

MIT License

966 stars 334 forks source link

Open neilyoung opened 8 years ago

neilyoung commented 8 years ago

After successful Login/Logout sequence I can login again by providing the correct username together with a wrong password.

neilyoung commented 8 years ago

I think it is a matter of wrong logical operator precedence. Change line 47 in backend/user-routes.js to

if (!(user.password === req.body.password)) {

chenkie commented 8 years ago

I can't seem to reproduce this--I can't log back in with the correct username but wrong password.