Login bug "Cannot read properties of null"

Wappler General Bugs
1

NodeJS
Docker

Haven’t touched the login flow for months, but it suddenly throws an error when using wrong credentials:

{"status":"500","message":"Cannot read properties of null (reading 'startsWith')","stack":"TypeError: Cannot read properties of null (reading 'startsWith')\n    at DatabaseProvider.validate (/opt/node_app/lib/auth/database.js:23:67)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async DatabaseProvider.login (/opt/node_app/lib/auth/provider.js:45:26)\n    at async App._exec (/opt/node_app/lib/core/app.js:578:30)\n    at async App._exec (/opt/node_app/lib/core/app.js:545:17)\n    at async App.exec (/opt/node_app/lib/core/app.js:514:9)\n    at async App.define (/opt/node_app/lib/core/app.js:496:9)"}

When providing correct credentials it logs in successfully.
My login server connect:

image
image2026×718 40.2 KB

My security provider properties:

image
image763×540 13 KB

2

Hi. Have seen this happen when the password is blank in the db for a given username.
Maybe it happens when username does not exist as well?

3

I just tried with some non existing usernames, they trigger 401 errors and show the correct validation.

So you might be correct, and the username I tried to use does exist but doesn’t have a password set.

I think both of these cases should throw the same 401 error, no?

4

Yes. I never posted this as a bug because I could not find a suitable use case.

I had such data because I migrated from another db, and encountered this error.
And another case was for new sign ups… But that meant I already have another set of steps before login attempt to handle it.

How do you have empty passwords?

5

Ah I see…

I have empty passwords because users can import email addresses (for example from their mailing list) and then invite their users to our software to set a password.

But it is a bit of an edge case I agree. Less worried about it at least, thanks :slight_smile:

1 Like
6

Don’t allow null values in the password field, use an empty string for empty password. Better is to prevent empty passwords since those accounts could be exploited. Better is to add the users with a random password and send them the password which they then can change or send them a password reset link.

3 Likes