Feat/ssad 0122/ ability to change user password#123
Conversation
|
Only fails Test Email API |
| [InlineData("")] | ||
| [InlineData(null)] | ||
| public void ShouldHaveError_WhenEmailIsEmpty(string email) | ||
| { |
There was a problem hiding this comment.
approved but format your tests with arrange act assert comments
DrFaust555
left a comment
DrFaust555
left a comment
There was a problem hiding this comment.
Problems:
-
SECURITY: Endpoint without [Authorize]
[HttpPost("change-password")] does not have the [Authorize] attribute. Anyone can try to change the password knowing the email and current password. This endpoint must require authentication. -
SECURITY: Email is taken from the body, not from the token
Handler accepts Email from the request body and looks for the user by it. This means that authenticated user A can try to change the password of user B if he knows his email and password. Correctly — take email from HttpContext.User.Claims (from the JWT token), and do not trust the body. -
build.yml contains an unnecessary change — adds a Test Email API step for a project that is not on dev. This came from merge and does not apply to the password feature. Because of this, CI crashes. It needs to be removed.
|
3 participants
dev
JIRA
Summary of change
Added an ability to change user password