From 0d9054211985ee4f331349f9815d9c15adde06e0 Mon Sep 17 00:00:00 2001 From: Alexis Loskoutoff Date: Sun, 25 Oct 2026 18:01:59 +0100 Subject: [PATCH] Give the same error for every failed login An unknown or passwordless account was rejected without the i18n key that a wrong password gets, so the response told which emails have an account. --- backend/internal/token.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/internal/token.js b/backend/internal/token.js index 67255b213..f7a8457a6 100644 --- a/backend/internal/token.js +++ b/backend/internal/token.js @@ -35,13 +35,13 @@ export default { .first(); if (!user) { - throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH); + throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH, ERROR_MESSAGE_INVALID_AUTH_I18N); } const auth = await authModel.query().where("user_id", "=", user.id).where("type", "=", "password").first(); if (!auth) { - throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH); + throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH, ERROR_MESSAGE_INVALID_AUTH_I18N); } const valid = await auth.verifyPassword(data.secret);