Hacker News Reader

Comment by abatilo | Hacker News Reader

Website is broken. I clicked register without putting anything into the fields, and I got a registered account with no user name and password. Now if you click login without anything put in, you get logged in to my account, and if I comment, the username is blank.

View on HN

Thank you for discovering this bug! We are (hot)fixing it. Had to delete your user though, please sign up again (with a normal username if possible :-D).

Define normal :) i now own the user " " with the password " " you might add trimming special characters and whitespace.

hahaha you're right! we've just setup the ^[a-zA-Z0-9_.-]+$ regex for both username and password. Thanks for the pen-testing

Do you really want that regex for passwords also? Am I not allowed to put interesting characters in my password?

Not sure this is ideal either, it rejected the first password my password manager generated. Password should probably just be anything other than all whitespace, no? Maybe a length requirement.

Sorry guys, do you like ^[A-Za-z0-9@#$%^&+=]+$ for your passwords?

You should not regex check your passwords at all. Just check !="" and maybe check the length There is no reason why you should limit symbols for passwords.

This times 1000. Why would you regex check your password? Check for empty string and length and be done with it.

You are right. Django default auth backend handles this perfectly, but we wanted that functionality of login + signup in the same form, and that signup autofill in case login fail, so made our custom auth views and screw up some things (like username and password validation and going back to previous page after login)

Reply on news.ycombinator.com