Login with invalid username or email displays 'Internal Server Error' message

[saralavanip]

Steps:

1. Visit https://apinf.io
2. Click on 'Login'
3. Enter non-registered username or email address
4. Enter valid password
5. Click on 'Sign In' button

Expected Result

Notify user with error message 'Invalid email address'

Actual Result

Displays 'Internal Server' error

Findings

• This scenario was also tested on https://nightly.apinf.io and the result is: displays error message 'Login forbidden' (login unsuccessful )as expected.

Browser

1. Mozilla Firefox 48.0
   (Mozilla Firefox for Ubuntu Canonical – 1.0 )
2. Google Chrome 52.0.2743.116

Operating System

Ubuntu 16.0 LTS

Screenshot

[bajiat]

@brylie Can you check if anything has changed in validate (?) login code after release 0.33?

[brylie]

There is a login_verify function that runs on the server when submitting the form. As of today, the most recent change to that file was on October 13th.

It is possible that recent changes to that file, or some other user login related function/configuration has resolved this issue in nightly.

[bajiat]

@jykae Please check this one after apinf.io is redeployed and settings have been changed

[jykae]

@bajiat Still results "Internal server error" in apinf.io

[brylie]

I think this is by design. If we submit an invalid email address, the security method may be designed to throw a 500 error to the client.

See

• Meteor audit-argument-checks