search

iainporter / oauth2-provider

Implementation of an oauth2 provider
Apache License 2.0
226 stars 181 forks source link

Sign up and login issues #12

Open tschaffter opened 10 years ago

tschaffter commented 10 years ago
  1. When signing up, the fields "Password" and "Confirm Password" are set to two different values.

Result: Form is accepted and redirection to Dashboard, console message: GET http://localhost:8080/oauth2-provider/v1.0/me 401 (Unauthorized) jquery-1.8.2.min.js:2

Expected: a message saying that the two passwords don't match

  1. Idem when signing up with "Password" and "Confirm Password" set to the SAME value (e.g. "password")

Result: Form is accepted and redirection to Dashboard, console message: GET http://localhost:8080/oauth2-provider/v1.0/me 401 (Unauthorized) jquery-1.8.2.min.js:2

  1. Logout after signing up, then login is impossible with correct credentials

Result: Message "Email and/or password did not match a user account." POST http://localhost:8080/oauth2-provider/oauth/token 400 (Bad Request) jquery-1.8.2.min.js:2

UPDATE: I numbered the points from 1. to 3. but they all appear as 1.

iainporter commented 10 years ago

Sorry, Been busy today so only just had a chance to look at this. The problem was in the javascript that I changed to handle my json payload experiment. I have reverted the commit and it should be good now.

tschaffter commented 10 years ago

Login is ok but entering two different passwords during signing up is still silently accepted.

A unit test using Karma or even an end-to-end test using Protector could prevent committing broken login interface. I may even write it myself, in which case I'll share the code with you.