From 124b5748c96dec70e91780383eb4cbda713723df Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Thu, 29 Jan 2026 08:51:17 -0500 Subject: [PATCH] fix: improve authentication validation and security - Trim whitespace from usernames and validate non-empty - Normalize role values to lowercase for case-insensitive comparison - Prevent registration with whitespace-only usernames - Maintain backward compatibility with existing functionality Fixes validation gap: Username whitespace handling --- internal/handlers/auth.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go index 07c2ff4..b02e60b 100644 --- a/internal/handlers/auth.go +++ b/internal/handlers/auth.go @@ -103,6 +103,20 @@ func (h *AuthHandler) Register(c echo.Context) error { return c.JSON(http.StatusBadRequest, map[string]string{"error": err.Error()}) } + // Additional validation: Trim whitespace from username + req.Username = strings.TrimSpace(req.Username) + if req.Username == "" { + if c.Request().Header.Get("HX-Request") == "true" { + return c.HTML(http.StatusBadRequest, `
Username cannot be empty or whitespace
`) + } + return c.JSON(http.StatusBadRequest, map[string]string{"error": "username cannot be empty or whitespace"}) + } + + // Normalize role to lowercase + if req.Role != "" { + req.Role = strings.ToLower(req.Role) + } + // Check if user already exists if _, err := h.db.GetUserByEmail(c.Request().Context(), req.Email); err == nil { if c.Request().Header.Get("HX-Request") == "true" {