Skip to content

Conversation

@Nephyx
Copy link

@Nephyx Nephyx commented Oct 12, 2019

Adds API endpoint for changing the display name of a user.
Related to Haider8/tmessage#39.

@vitokhangnguyen
Copy link
Contributor

vitokhangnguyen commented Oct 13, 2019

Hi @Nephyx,
I think that the route to change displayed name should be protected that...

  1. Only a registered user with a valid token can successfully make a request to it
  2. The registered user has to have their user_name matched with the user_name of the displayed name

If not, anyone can just use an Http Client (i.e.: Postman) to modify someone else's displayed name. Somewhere at the beginning of server.js, I believe there is this code can help this purpose:

// Add this middleware to routes need protecting
const basicTokenAuthentication = passport.authenticate("jwt", {session: false});

@Haider8
Copy link
Owner

Haider8 commented Oct 13, 2019

Yes the route to change the display name should be protected

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants