Replies: 1 comment
-
I think it should be done, if only to make things consistent across all users. There's no reason why a login call should succeed in this case where it would fail elsewhere, in my opinion. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
See RetroAchievements/rcheevos#153
For Unregistered users currently, the login call succeeds, and any other calls made using the token returned by the login call fail with a generic "Credentials Invalid (0)" error.
I know there are security reasons for not explaining why a login call fails, but in this case, we're past the login.
Any dorequest call that fails due to the user's permission level return "Credentials Invalid ({current level})". A simple change would be to make this "Access Denied ({current level})". "Credentials Invalid" could be returned when the token is invalid, but goes back to the security concern.
Additionally, as we know Unregistered users won't be able to do anything, should the login call be modified to return a failure message to prevent the client from acting as if things are alright?
Beta Was this translation helpful? Give feedback.
All reactions