fix(login): send back 401 Unauthorized on failed login attempt

pano9000 · pano9000 · commit fa350e13f6e8 · 2025-04-15T08:48:57.000+02:00
diff --git a/src/routes/login.ts b/src/routes/login.ts
@@ -134,7 +134,7 @@ function sendLoginError(req: Request, res: Response, errorType: 'password' | 'to
         log.info(`WARNING: Wrong password from ${req.ip}, rejecting.`);
     }
 
-    res.render('login', {
+    res.status(401).render('login', {
         wrongPassword: errorType === 'password',
         wrongTotp: errorType === 'totp',
         totpEnabled: totp.isTotpEnabled(),

Original file line number	Diff line number	Diff line change
`@@ -134,7 +134,7 @@ function sendLoginError(req: Request, res: Response, errorType: 'password' \| 'to`
`134`	`134`	log.info(`WARNING: Wrong password from ${req.ip}, rejecting.`);
`135`	`135`	`}`
`136`	`136`
`137`		`- res.render('login', {`
	`137`	`+ res.status(401).render('login', {`
`138`	`138`	`wrongPassword: errorType === 'password',`
`139`	`139`	`wrongTotp: errorType === 'totp',`
`140`	`140`	`totpEnabled: totp.isTotpEnabled(),`