Skip to content

Impove account register/login security and tests coverage #94

@robert-dorna

Description

@robert-dorna

Frontend is currently storing JWT token in localStorage. We should use cookies with HttpOnly, Secure and SameSite at least Lax, and maybe something more (domain etc.) idk everything about cookies hardening, will need to check mdn again.

Also, currently Auth page (login and register) do not have tests for interactions which check:

  • redirects when attempted to be open when user is already registered
  • that for bad input requests are not made (e.g. missing password or mismatching passwords in register)
  • for good inputs requests are made (mocked) and page correctly adapts to response:
    • redirects on success to account page
    • displays proper error and highlights proper form parts on error (username taken, server unavailable, etc.)

So... After implementing JWT with cookies on backend, adapt frontend to use those cookies instead of localStorage and then adapt existing tests and add missing ones listed above.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugRequest to fix incorrect behavior observed in the app

    Type

    No type

    Projects

    Status

    Refined

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions