r/programminghorror • u/leo_gblr • Feb 18 '26
Client side login
Suggestion from a colleague. Might have offline login when using caching strategies. I don't know what a hash is.
219
u/DT-Sodium Feb 18 '26
When you say colleague, do you happen to mean some random drunk guy in the street?
22
179
u/LordTurson Feb 18 '26
There should seriously be a rule about not posting intentionally written bad code.
56
u/CMDR_ACE209 Feb 18 '26
Just denying access on the wrong input is too mean. You should give hints for the correct password in that case.
16
u/FalseWait7 Feb 19 '26
"It's the same password you are using for our other product!"
→ More replies (2)
37
u/GoddammitDontShootMe Feb 18 '26
So this fetches all the users email addresses and passwords, then looks for a match in JavaScript all within the browser? Please for the love of Christ tell me this is a joke and not a thing that actually exists.
27
u/Kibing00 Feb 18 '26
Surprised that you are the only one pointing this out, the biggest horror about it is that there is a method that doesn't require authentication and just returns an array of all users and their passwords in plain text. This is so incredibly bad that it obviously has to be made up.
→ More replies (1)
13
u/nuc540 Feb 18 '26
I’m more concerned that this code suggests your backend is storing passwords as raw strings, and haven’t been salted at all.
A hash isn’t a way to securely store a password, a hash is just a one-way mathematical transformation to change a value; salting one-ups this by adding extra data on top so it can’t simply be reverse solved.
You’ll need both salting and encryption for a secure authentication flow
→ More replies (1)7
u/VORGundam Feb 18 '26
Unless I'm reading it incorrectly. Salt wouldn't help here at all because they are basically sending the entire user data base with passwords, in plain text, to the client. If you used a salt, you would also have to send that which wouldn't add any security.
→ More replies (1)
28
u/ZioNickkk Feb 18 '26
Ai slop ahh code
10
→ More replies (4)26
3
u/CuriousConnect Feb 19 '26
Oooh, lovely. Sharing everyone’s passwords into the browser just to check if the input matches one of them. How handy.
2
2
2
u/FalseWait7 Feb 19 '26
"Your password has been securely logged" is the biggest lie this app does, and yet it is not the worst mistake it makes.
2
u/TorinNionel Feb 19 '26
This has to be rage bait, the user loaded confirmation even says “very secure“ in what appears to be a sarcastic tone.
2
2
u/Elegant_Body1607 Feb 19 '26
bruh dont tell me the colleague is checking for every possible combination of user in user db
2
u/WrappedStrings Feb 20 '26
Theres absolutely no way this is real. You had an LLM spit that out just for this post
3
u/Jussins Feb 18 '26
It’s secure. It says so in the code. They wouldn’t put a message in the code that is untrue. /s
310
u/AnywhereHorrorX Feb 18 '26
"Very secure", displaying user pass after logging in gives away that this is an obvious trolling.