Why is the current user being set in the context before the password is validated? In auth.go
authUser := authboss.MustBeAuthable(pidUser)
password := authUser.GetPassword()
// Sets the current user first?
r = r.WithContext(context.WithValue(r.Context(), authboss.CTXKeyUser, pidUser))
// Then validates the password???
var handled bool
err = bcrypt.CompareHashAndPassword(....
And in context.go, the CurrentUser method returns the same context value as the current user:
func (a *Authboss) CurrentUser(r *http.Request) (User, error) {
if user := r.Context().Value(CTXKeyUser); user != nil {
return user.(User), nil
}
...
Is there a gaping security hole where the current user being set even if the login fails? What am I missing here?
I realized that context is only stored during the request lifecycle, and is freed after the response is sent back. The uset context is stored for use by other middleware.
Why is the current user being set in the context before the password is validated? In auth.go
And in context.go, the CurrentUser method returns the same context value as the current user:
Is there a gaping security hole where the current user being set even if the login fails? What am I missing here?