-
Notifications
You must be signed in to change notification settings - Fork 1
Open
Description
Description
Server actions handling sensitive user data (email, password) currently lack proper input validation, relying only on client-side validation which can be bypassed.
Affected Files
apps/web/src/app/signup/action.tsapps/web/src/app/signin/action.tsapps/web/src/app/reset/action.ts
Security Concern
The current implementation uses type casting without validation:
- Email format validation is missing
- Password complexity requirements are not enforced server-side
- Input sanitization is not performed
This creates a security vulnerability where malformed or malicious input could be processed.
Context
This issue was identified during code review and acknowledged with a comment in the code stating 'in practice, you should validate your inputs' but the validation is not implemented.
References
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Projects
Status
In Progress