@@ -55,48 +55,54 @@ router.get('/register', async function (req, res) {
5555 } ) ;
5656} ) ;
5757
58- router . get ( '/login' , async function ( req , res ) {
59- const username = req . query . username ;
60- const password = req . query . password ;
61-
62- // check if user exists
63- // vulnerable to sql injection because prepared statements are not used
64- // https://snyk.io/de/blog/preventing-sql-injection-attacks-node-js/
65- const vulnerableQuery = database . checkUserExistsQuery . replace ( '?' , `"${ username } ) ;
66- const result = await database . dbConnection . query ( vulnerableQuery ) ;
67- if ( result [ 0 ] . length < 1 ) {
68- res . status ( 404 ) . json ( { message : "Given user does not exists!" } )
69- return
70- }
71-
72- const user = result [ 0 ] [ 0 ] ;
73- const roles = await database . dbConnection . query ( database . selectUserWithRole , [ user . id ] ) . then ( ( response ) => {
74- const userWithRoles = response [ 0 ] ;
75- if ( userWithRoles . length === 0 ) {
76- return [ ] ;
58+ router . get ( '/login' , async function ( req , res , next ) {
59+ try {
60+ const username = req . query . username ;
61+ const password = req . query . password ;
62+
63+ // check if user exists
64+ // vulnerable to sql injection because prepared statements are not used
65+ // https://snyk.io/de/blog/preventing-sql-injection-attacks-node-js/
66+ const vulnerableQuery = database . checkUserExistsQuery . replace ( '?' , `"${ username } ) ;
67+ const result = await database . dbConnection . query ( vulnerableQuery ) ;
68+ if ( result [ 0 ] . length < 1 ) {
69+ res . status ( 404 ) . json ( { message : "Given user does not exists!" } )
70+ return
7771 }
7872
79- const userRoles = [ ] ;
80- userWithRoles . forEach ( user => {
81- if ( user . role_name !== null ) {
82- userRoles . push ( "" + user . role_name ) ;
73+ const user = result [ 0 ] [ 0 ] ;
74+ const roles = await database . dbConnection . query ( database . selectUserWithRole , [ user . id ] ) . then ( ( response ) => {
75+ const userWithRoles = response [ 0 ] ;
76+ if ( userWithRoles . length === 0 ) {
77+ return [ ] ;
8378 }
79+
80+ const userRoles = [ ] ;
81+ userWithRoles . forEach ( user => {
82+ if ( user . role_name !== null ) {
83+ userRoles . push ( "" + user . role_name ) ;
84+ }
85+ } ) ;
86+
87+ return userRoles ;
8488 } ) ;
8589
86- return userRoles ;
87- } ) ;
8890
91+ bcrypt . compare ( password , user . password_hash , function ( err , compareResult ) {
92+ if ( compareResult ) {
93+ res . json ( {
94+ result : "successfully logged in!" ,
95+ jwt : jwtUtil . generateJwtAccessToken ( username , user . id , roles )
96+ } )
97+ } else {
98+ res . status ( 401 ) . json ( { message : 'Wrong password!' } )
99+ }
100+ } ) ;
89101
90- bcrypt . compare ( password , user . password_hash , function ( err , compareResult ) {
91- if ( compareResult ) {
92- res . json ( {
93- result : "successfully logged in!" ,
94- jwt : jwtUtil . generateJwtAccessToken ( username , user . id , roles )
95- } )
96- } else {
97- res . status ( 401 ) . json ( { message : 'Wrong password!' } )
98- }
99- } ) ;
102+ } catch ( err ) {
103+ console . error ( err ) ;
104+ next ( err ) ;
105+ }
100106} ) ;
101107
102108router . post ( '/username' , async function ( req , res ) {
0 commit comments