Can Meteor.loginWithPassword be changed to return a generic error?

user_1925794 0
Viewed 228

Using Meteor, the Meteor.loginWithPassword function calls the server, which then returns a User not found error when the user does not exist, or a Match failed when the password does not match the user's password.

Is there an easy way for the server to return the same error (or no error) during both conditions of a failed login?

I don't want hackers to know when they found a valid username or UserID on my system. I don't want the server to say User not found, telling potential hackers when they have (or have not) found a valid user. It would be great if there's an easy way to change the error message the server returns from the accounts-password Meteor module, to harden the security a little bit. I'd like the server's error result to be something generic, like failed or undefined or null, regardless of the reason of the login error.

I know I can probably fork/re-purpose the accounts-password module, but hoping there's something simpler.

Thanks!

meteor
1 Answers

Yes, you can place the function somewhere in the /server-folder and change the error message. Like this:

Accounts.validateLoginAttempt(function(options) {
  if (!options.allowed) { //that is, if there's an error
    throw new Meteor.Error('login-error', 'Error!');
  }
//...other code for other purposes below
});

/server/accounts.js

user_27467420
Related