Eternal Posts - Answer Overflow

Eternal

Explore posts from servers

•Created by Eternal on 8/25/2024 in #questions

Should the server respond with the error or a generic "try again" message?

If a user makes an API request to the backend and the request fails because the database had an issue, should the server reply with the error that was thrown or should the server reply with a generic "Something went wrong" message? I'm leaning towards the generic error messages because showing the error that was thrown could allow an attacker to infer what database your using, and usually, you want to hide as much information about your backend from an attacker. But showing the actual error message would allow users to report bugs and show the developers the actual error message. I'm curious to hear your thoughts on this.

10 replies

TTCTheo's Typesafe Cult

•Created by Eternal on 3/15/2024 in #questions

rolling your own auth

Does hashing passwords with argon2 and authenticating users with a token thats generated when their account is created count as "rolling your own auth"? When should i stop " rolling my own auth"? Do i need a service like that if i dont plan on intergrating "login with google" or whatever?

5 replies

TTCTheo's Typesafe Cult

•Created by Eternal on 2/18/2023 in #questions

New to fullstack

So..uhh. New to full stack. Are there any frameworks I should be using? Javascript, CSS or other wise? What are states? Why does type safty matter? What are some things I should learn and deep dive in? Whats the difference between Vue and Angular and React? What should I be using, assuming I am new and I dont want to sink a lot of time into a framework? I want an easy to use and learn framework. How do I package and send the code I wrote for that framework to the client and they can run it? How do I scale when I have a TON of users?

11 replies

TTCTheo's Typesafe Cult

•Created by Eternal on 2/17/2023 in #questions

ExpressJS router not working

const express = require("express");
const database = require("../database.js")
const argon2 = require('argon2')
const router = express.Router();

router.post("/api/login", async (req, res) => {
    const data = await database.get_password(req.body.username)
    console.log("hei")
    if (data.success == false) {
        res.json({
            token: null,
            error: "User does not exist or password is wrong"
        })
        return
    }

    //check password
    const valid = await argon2.verify(data.password, req.body.password)
    if (valid) {
        res.json({
            token: data.token,
            error: null
        })
    } else {
        res.json({
            token: null,
            error: "User does not exist or password is wrong"
        })
    }
})

module.exports = router;

const express = require("express");
const database = require("../database.js")
const argon2 = require('argon2')
const router = express.Router();

router.post("/api/login", async (req, res) => {
    const data = await database.get_password(req.body.username)
    console.log("hei")
    if (data.success == false) {
        res.json({
            token: null,
            error: "User does not exist or password is wrong"
        })
        return
    }

    //check password
    const valid = await argon2.verify(data.password, req.body.password)
    if (valid) {
        res.json({
            token: data.token,
            error: null
        })
    } else {
        res.json({
            token: null,
            error: "User does not exist or password is wrong"
        })
    }
})

module.exports = router;

server.js

const api_login_router = require("./routes/login")
app.use("/api/login", api_login_router);

const api_login_router = require("./routes/login")
app.use("/api/login", api_login_router);

All varaibles are defined and server is up on port 3000. If I remove it from routes and use app.post() instead of using a route, it works just fine I think whats going on is that the route is never registered the file exists in the path specified

2 replies

Gaming

Programming