refactor: Improve registration validation and captcha security

commit: 38bffedd1f98af5f51c7ff0454097036a6717db8
author: Kit · 20mo ago · 2025-02-18 06:41 UTC
parent: 3d77915
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +6 -1

M src/routes/api/register/+server.ts +6 -1


@@ -73,7 +73,7 @@ export const POST: RequestHandler = async ({ request }) => {
73	73
74	74		// Validate PDR captcha
75	75		const normalizedAnswer = captchaAnswer.trim().toLowerCase();
76		-	if (normalizedAnswer !== 'poudlard' && normalizedAnswer !== 'poudlard rp') {
	76	+	if (normalizedAnswer !== 'point de rencontre') {
77	77		attemptData.count++;
78	78		attemptData.lastAttempt = now;
79	79		captchaAttempts.set(ip, attemptData);

@@ -102,6 +102,11 @@ export const POST: RequestHandler = async ({ request }) => {
102	102		return new Response(JSON.stringify({ error: 'All fields must be filled' } as RegisterResponseError), { status: 400 });
103	103		}
104	104
	105	+	if (username.length < 3) {
	106	+	log.warn('Username must be at least 3 characters');
	107	+	return new Response(JSON.stringify({ error: 'Username must be at least 3 characters' } as RegisterResponseError), { status: 400 });
	108	+	}
	109	+
105	110		if (username.length > 32) {
106	111		log.warn('Username must be at most 32 characters');
107	112		return new Response(JSON.stringify({ error: 'Username must be at most 32 characters' } as RegisterResponseError), { status: 400 });

 	// Validate PDR captcha
 	const normalizedAnswer = captchaAnswer.trim().toLowerCase();
-	if (normalizedAnswer !== 'poudlard' && normalizedAnswer !== 'poudlard rp') {
+	if (normalizedAnswer !== 'point de rencontre') {
 		attemptData.count++;
 		attemptData.lastAttempt = now;
 		captchaAttempts.set(ip, attemptData);
 		return new Response(JSON.stringify({ error: 'All fields must be filled' } as RegisterResponseError), { status: 400 });
 	}
+	if (username.length < 3) {
+		log.warn('Username must be at least 3 characters');
+		return new Response(JSON.stringify({ error: 'Username must be at least 3 characters' } as RegisterResponseError), { status: 400 });
+	}
 	if (username.length > 32) {
 		log.warn('Username must be at most 32 characters');
 		return new Response(JSON.stringify({ error: 'Username must be at most 32 characters' } as RegisterResponseError), { status: 400 });