Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Force emails to be unique with mongo #51

Merged
merged 2 commits into from
Jan 22, 2018
Merged

Conversation

patins
Copy link
Contributor

@patins patins commented Dec 31, 2017

During HackMIT 2017, we found multiple users with the same email address. This can happen if a user hits register repeatedly. This change forces user email addresses to be unique by using mongoose's unique constraint.

This change forces user email addresses to be unique by using mongoose's
unique constraint.
Copy link

@DaleMitchell DaleMitchell left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems to work okay, but not sure why generateHash was moved from out of the else to before if(err)... maybe it doesn't really matter but I would think it would make more sense to keep generateHash inside the else because then if the user already exists then the server won't have to perform the unnecessary password hash computation.

Copy link
Contributor

@jlin816 jlin816 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, just add a small clarifying comment 🙂 @DaleMitchell makes a good point, but I'm indifferent towards whether you want to move that into the else because it's a small optimization and it seems slightly easier to read / neater to set the email and password in the same place. Up to you!

u.password = User.generateHash(password);
u.save(function(err){
if (err){
if (err.name === 'MongoError' && (err.code === 11000 || err.code === 11001)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a comment here about what the hard-coded error codes mean?

@patins
Copy link
Contributor Author

patins commented Jan 22, 2018

It doesn't make sense to move the generatePassword into the else. It would require another db save, which would ultimately be less efficient.

@jlin816
Copy link
Contributor

jlin816 commented Jan 22, 2018

Mmm, you're right.

Thanks Pat!

@jlin816 jlin816 merged commit d9e2892 into techx:master Jan 22, 2018
@DaleMitchell
Copy link

The more I know then 😄

@ehzhang
Copy link
Contributor

ehzhang commented Jan 22, 2018

Why not add a debounce to the login/signup page as well?

prabhanshuguptagit pushed a commit to prabhanshuguptagit/quill that referenced this pull request Jan 23, 2019
Force emails to be unique with mongo
jtviolet pushed a commit to jtviolet/fountain that referenced this pull request Aug 13, 2019
Force emails to be unique with mongo
jtviolet pushed a commit to jtviolet/fountain that referenced this pull request Aug 13, 2019
Force emails to be unique with mongo
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants