search

datalust / seq-tickets

Issues, design discussions and feature roadmap for the Seq log server
https://datalust.co/seq
98 stars 5 forks source link

Login fails when password contains double quote #2253

Closed simon-chester closed 2 months ago

simon-chester commented 3 months ago

Attempt to sign-in to Seq as a user that has at least 1 double-quote (") in their password. Sign fails even though credentials have been entered correctly.

(If you look at the request payload to /api/users/login, you'll see that the double-quote character is unexpectedly prepended by a backslash.)

Environment (please complete the following information):

My love for Seq is undiminished 😂

KodrAus commented 3 months ago

Thanks for the report @simon-chester!

KodrAus commented 3 months ago

Hi @simon-chester :wave: We weren't able to reproduce this ourselves; the \" escaping is what you'd expect to see inside a JSON string, and is unescaped server-side. Are you trying to sign in via the built-in username/password scheme or via OIDC/EntraID?

Feel free to drop us a line at our support@datalust.co address with any more details if you'd like.

simon-chester commented 3 months ago

Hi @KodrAus, Thanks for looking at this.

Yes, that makes perfect sense about the JSON escaping (sorry, it was the end of a long day when I opened this issue last night 🥱).

I was using the built-in username/password. Here's a video: https://www.youtube.com/watch?v=OrrwhaAbfYw

simon-chester commented 3 months ago

..... Just as a quick sanity-check... Here's another of me then removing the double-quote, and the login then succeeding: https://youtu.be/pm8_eNcDtu4

liammclennan commented 3 months ago

Hi Simon,

The problem is likely to be that your shell is messing with the quotes. You can use the --password-stdin option, or set your password in Seq.

It is also possible to escape the quotes in command line arguments, but the rules are complicated and different for every shell.

simon-chester commented 2 months ago

Hi @liammclennan, Thank you - that makes perfect sense. Thanks for your help.