From 2dde0bf1c7b294a84fd8147706ca64e006ae5d8a Mon Sep 17 00:00:00 2001 From: advplyr Date: Tue, 10 Nov 2026 19:33:57 -0600 Subject: [PATCH 1/2] Validate credentials are string --- server/auth/LocalAuthStrategy.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/server/auth/LocalAuthStrategy.js b/server/auth/LocalAuthStrategy.js index e9499d13d..6602c18fd 100644 --- a/server/auth/LocalAuthStrategy.js +++ b/server/auth/LocalAuthStrategy.js @@ -49,6 +49,12 @@ class LocalAuthStrategy { * @param {Function} done - Passport callback */ async verifyCredentials(req, username, password, done) { + if (typeof username !== 'string' || typeof password !== 'string') { + this.logFailedLoginAttempt(req, typeof username === 'string' ? username : '[non-string]', 'Invalid username or password') + done(null, null) + return + } + // Load the user given it's username const user = await Database.userModel.getUserByUsername(username.toLowerCase()) From 3e0333877b8c8b18e7eb06180f991842ad13473b Mon Sep 17 00:00:00 2001 From: advplyr Date: Wed, 11 Nov 2026 19:09:00 -0600 Subject: [PATCH 2/2] Fix server crash on logout --- server/auth/OidcAuthStrategy.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/server/auth/OidcAuthStrategy.js b/server/auth/OidcAuthStrategy.js index 9cb78b257..fb43bbd94 100644 --- a/server/auth/OidcAuthStrategy.js +++ b/server/auth/OidcAuthStrategy.js @@ -393,7 +393,15 @@ class OidcAuthStrategy { * @returns {string|null} */ getEndSessionUrl(req, idToken, authMethod) { - const client = this.getClient() + // Logout trusts the auth_method cookie. getClient() throws when OpenID is not + // configured, and that throw is outside the request promise, so it exits the process. + let client + try { + client = this.getClient() + } catch (error) { + Logger.error(`[OidcAuth] Cannot build end session URL - ${error.message}`) + return null + } if (client.issuer.end_session_endpoint && client.issuer.end_session_endpoint.length > 0) { let postLogoutRedirectUri = null