Merge pull request #1708 from TriliumNext/fix_http-code-failed-login_#1707

eliandoran · web-flow · commit 0f06bf43f01d · 2025-04-15T13:12:28.000+03:00
fix(login): send back 401 Unauthorized on failed login attempt
diff --git a/src/routes/login.ts b/src/routes/login.ts
@@ -133,7 +133,7 @@ function sendLoginError(req: Request, res: Response, errorType: 'password' | 'to
         log.info(`WARNING: Wrong password from ${req.ip}, rejecting.`);
     }
 
-    res.render('login', {
+    res.status(401).render('login', {
         wrongPassword: errorType === 'password',
         wrongTotp: errorType === 'totp',
         totpEnabled: totp.isTotpEnabled(),

Original file line number	Diff line number	Diff line change
`@@ -133,7 +133,7 @@ function sendLoginError(req: Request, res: Response, errorType: 'password' \| 'to`
`133`	`133`	log.info(`WARNING: Wrong password from ${req.ip}, rejecting.`);
`134`	`134`	`}`
`135`	`135`
`136`		`- res.render('login', {`
	`136`	`+ res.status(401).render('login', {`
`137`	`137`	`wrongPassword: errorType === 'password',`
`138`	`138`	`wrongTotp: errorType === 'totp',`
`139`	`139`	`totpEnabled: totp.isTotpEnabled(),`