fix(login): send back 401 Unauthorized on failed login attempt
This commit is contained in:
Elian Doran 2025-04-15 13:12:28 +03:00 committed by GitHub
commit 0f06bf43f0
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -133,7 +133,7 @@ function sendLoginError(req: Request, res: Response, errorType: 'password' | 'to
log.info(`WARNING: Wrong password from ${req.ip}, rejecting.`);
}
res.render('login', {
res.status(401).render('login', {
wrongPassword: errorType === 'password',
wrongTotp: errorType === 'totp',
totpEnabled: totp.isTotpEnabled(),