Bug Summary
In backend/controllers/auth.controller.js, the login function returns res.json({ loginStatus: false, Error: 'Invalid Credentials' }) with the default HTTP 200 status code when authentication fails:
if (!match) {
return res.json({ loginStatus: false, Error: 'Invalid Credentials' });
}This is an HTTP anti-pattern. Security middleware, CDN caches, analytics tools, and client-side interceptors that inspect status codes will treat a failed login as a successful (200 OK) request.
Steps to Reproduce
- Send
POST /api/auth/login with a valid email and an incorrect password.
- Inspect the HTTP response status code.
- Observe
200 OK instead of 401 Unauthorized.
Expected Behavior
Authentication failures should return HTTP 401:
return res.status(401).json({ loginStatus: false, Error: 'Invalid Credentials' });The same fix applies to the user not found branch above it.
Actual Behavior
Failed login returns 200 OK with a JSON body indicating failure. Security tools that monitor for unauthorized access patterns cannot detect brute-force attempts based on HTTP status codes alone.
Environment
- Backend: Node.js / Express
- File:
backend/controllers/auth.controller.js, function: login
Additional Context
Expected NSOC points: NSOC'26 level1 (beginner - incorrect HTTP status code with security implications)
Suggested labels: bug, NSOC'26, level1
Checklist:
Bug Summary
In
backend/controllers/auth.controller.js, theloginfunction returnsres.json({ loginStatus: false, Error: 'Invalid Credentials' })with the default HTTP 200 status code when authentication fails:This is an HTTP anti-pattern. Security middleware, CDN caches, analytics tools, and client-side interceptors that inspect status codes will treat a failed login as a successful (200 OK) request.
Steps to Reproduce
POST /api/auth/loginwith a valid email and an incorrect password.200 OKinstead of401 Unauthorized.Expected Behavior
Authentication failures should return HTTP 401:
The same fix applies to the
user not foundbranch above it.Actual Behavior
Failed login returns
200 OKwith a JSON body indicating failure. Security tools that monitor for unauthorized access patterns cannot detect brute-force attempts based on HTTP status codes alone.Environment
backend/controllers/auth.controller.js, function:loginAdditional Context
Expected NSOC points: NSOC'26 level1 (beginner - incorrect HTTP status code with security implications)
Suggested labels:
bug,NSOC'26,level1Checklist: