ishaanbedi/woyage

Instance of content spoofing when signing up / logging in

ishaanbedi opened this issue · 0 comments

When being on the login or signup page, any kind of error is displayed based on the incoming request from Supabase Auth mechanism, which is parsed from the parameter query.

Any kind of alteration of the error in the query reflects on the page as an error.

This is a minor security concern, which can be used to trick people:

Screenshot 2024-07-11 at 8 02 45 PM

Possible fixes:

  • Render the error without the whole parameter thing by internally syncing the errors.
  • Cross verifying the error (somehow, maybe?)