Avoid getting the hashed_password when not necessary #41

New Issue

Sceptique · 2021-06-14T23:06:58+02:00

Sceptique commented

2021-06-14 23:06:58 +02:00

1. don't select the password

auth.rb:L30

      @current_user = LifePex::User.where(id: user_id_decoded(cookies)).first

We should not select the hashed_password by default

2. drop the password after use

login/register should not need user.password after use. drop the field

## 1. don't select the password auth.rb:L30 ``` @current_user = LifePex::User.where(id: user_id_decoded(cookies)).first ``` We should not select the hashed_password by default ## 2. drop the password after use login/register should not need user.password after use. drop the field

Sceptique added the

security

label 2021-06-14 23:06:58 +02:00

Sceptique added this to the To sort project 2021-06-16 19:45:52 +02:00

Sign in to join this conversation.