fix(security): remove JWT role extraction without signature, add OTP replay protection, fix user enumeration

2026-06-17 06:45:53 +03:00
parent 81376a2245
commit 3dad979eb5
3 changed files with 15 additions and 37 deletions
--- a/backend/auth/login.php
+++ b/backend/auth/login.php
@@ -54,14 +54,12 @@ if ($count > 0) {
        ]);
        // jsonError("Incorrect password.");
    }
-} else {
-    // The user does not exist
-    echo json_encode([
-            "status" => "Failure",
-            "data" => "User does not exist."
-        ]);
-    // jsonError("User does not exist.");
-}
-$conn->close();
+    } else {
+        echo json_encode([
+                "status" => "Failure",
+                "data" => "Invalid credentials."
+            ]);
+    }
+$con = null;

 ?>