review: move the execution time of the validateUserCredentials method…

… before assigning true to the session.passwordValid
curveball · Oct 9, 2024 · 3a52f2f · 3a52f2f
1 parent 33288d2
commit 3a52f2f
Showing 1 changed file with 10 additions and 10 deletions.
diff --git a/src/login/service.ts b/src/login/service.ts
@@ -230,6 +230,16 @@ async function challengeUsernamePassword(session: LoginSession, username: string
     );
   }
 
+  const { success, errorMessage } = await services.user.validateUserCredentials(user, password, ctx);
+  if (!success && errorMessage) {
+    throw new A12nLoginChallengeError(
+      session,
+      errorMessage,
+      'username-password',
+      true,
+    );
+  }
+
   session.principalId = user.id;
   session.passwordValid = true;
   session.dirty = true;
@@ -251,16 +261,6 @@ async function challengeUsernamePassword(session: LoginSession, username: string
     );
   }
 
-  const { success, errorMessage } = await services.user.validateUserCredentials(user, password, ctx);
-  if (!success && errorMessage) {
-    throw new A12nLoginChallengeError(
-      session,
-      errorMessage,
-      'username-password',
-      true,
-    );
-  }
-
   return user;
 }