Instance of content spoofing when signing up / logging in
ishaanbedi opened this issue · 0 comments
ishaanbedi commented
When being on the login
or signup
page, any kind of error is displayed based on the incoming request from Supabase Auth mechanism, which is parsed from the parameter query.
Any kind of alteration of the error in the query reflects on the page as an error.
This is a minor security concern, which can be used to trick people:
Possible fixes:
- Render the error without the whole parameter thing by internally syncing the errors.
- Cross verifying the error (somehow, maybe?)