search

mozilla / id.webmaker.org

OAuth 2.0 identity provider for Webmaker
https://id.webmaker.org
Mozilla Public License 2.0
18 stars 51 forks source link

bad usernames during sign up are not always getting flagged #387

Open Pomax opened 9 years ago

Pomax commented 9 years ago

Right now we store usernames in all lowercase, but users can sign up through id.wmo with capitalisation in their name. A user can sign up as "TESTOLATOR", which will then be stored as "testolator".

If another user then tries to sign up as "TestOLatoR", there is no frontend signal that this username is already taken, despite the fact that id.wmo on the console logs the fact that the username's already taken, and sends back a 400 error.

jbuck commented 9 years ago

So the problem is that we're not detecting duplicate usernames

Pomax commented 9 years ago

further details: login.wmo seems to silently .toLowerCase() usernames, rather than this being somehow super explicit