skip to content

detached 5794674

fix(security): stop trimming passwords to preserve intentional whitespace

commit: 5794674601e7001a863701bf5f53e98362423d70
author: Kit · 8mo ago · 2026-02-16 11:02 UTC
parent: d075a17
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

2 files · +2 -2

M src/routes/api/register/+server.ts +1 -1


@@ -105,7 +105,7 @@ export const POST: RequestHandler = async ({ request, getClientAddress }) => {
105	105
106	106		// Trim input values (validation already done by Zod)
107	107		const username = suUsername.trim();
108		-	const password = suPassword.trim();
	108	+	const password = suPassword;
109	109
110	110		// Check if nickname already exists using Convex
111	111		const existingUser = await users.getByNickname(username);


@@ -105,7 +105,7 @@ export const POST: RequestHandler = async ({ request, getClientAddress }) => {
105			105
106		// Trim input values (validation already done by Zod)	106		// Trim input values (validation already done by Zod)
107		const username = suUsername.trim();	107		const username = suUsername.trim();
108	-	const password = suPassword.trim();	108	+	const password = suPassword;
109			109
110		// Check if nickname already exists using Convex	110		// Check if nickname already exists using Convex
111		const existingUser = await users.getByNickname(username);	111		const existingUser = await users.getByNickname(username);

M src/routes/api/session/login/+server.ts +1 -1


@@ -112,7 +112,7 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress
112	112
113	113		// Verify password
114	114		try {
115		-	const isValid = await verifyPassword(password.trim(), user.password);
	115	+	const isValid = await verifyPassword(password, user.password);
116	116		if (!isValid) {
117	117		attemptData.count++;
118	118		attemptData.lastAttempt = now;


@@ -112,7 +112,7 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress
112			112
113		// Verify password	113		// Verify password
114		try {	114		try {
115	-	const isValid = await verifyPassword(password.trim(), user.password);	115	+	const isValid = await verifyPassword(password, user.password);
116		if (!isValid) {	116		if (!isValid) {
117		attemptData.count++;	117		attemptData.count++;
118		attemptData.lastAttempt = now;	118		attemptData.lastAttempt = now;