search

nxus / users

User management module for Nxus apps.
MIT License
0 stars 0 forks source link

Problematic error message when registering new account with same email as existing. #36

Open davidkellerman opened 7 years ago

davidkellerman commented 7 years ago

The Waterline MongoDB adapter produces an error like this:

[Error (E_UNKNOWN) Encountered an unexpected error] Details: WriteError({"code":11000,"index":0,"errmsg":"E11000 duplicate key error index: heroku_w8jt3kcj.users-user.$email dup key: { : \"mike@seabourneconsulting.com\" }","op":{"email":"mike@seabourneconsulting.com","password":"1719e251c7c50211b0f21eeae42e16b71f6c0c901b418982d3e9b3c97be49ba4","nameFirst":"Someone","nameLast":"Else","updateActionPlan":"on","terms":"on","enabled":true,"verified":false,"role":0,"admin":false,"metadata":{},"salt":"79abb9f0433bc906f563a142cb43a8c4514cf566dedd7516","verifyToken":"b40c202679a21604be98e797e83166ac","resetPasswordToken":"6075f38da1f5729ea71b52cd00680710","createdAt":"2017-06-27T04:50:05.554Z","updatedAt":"2017-06-27T04:50:05.554Z","_id":"5951e3fd28f2f72e00f4a0b5"}})

Not only is this ugly if reported to the user, but it potentially leaks sensitive information (the salt value, for example, although this probably isn't too awful).

I've put explicit code into the 100mhl-platform to check for this case, but that seems like the "wrong" place for it.

We could check here in nxus-users for a name collision and deliver a custom error message. However, other database errors potentially could cause similar problems. So, maybe give a custom message for duplicate names, and generic message for other database errors?

loppear commented 6 years ago

Actually, right now this module doesn't provide any registration view or support - it probably should, as a configurable option, and when it does should handle these errors - agree with helpful duplicate vs generic error messages.