Currently application/backend/src/authentication.ts does not check the provided UserID exists in the DB (as it is only called after a user is inserted or queried). I think it probably should - the cost of an extra db query may be probably worth the extra security. I see there is a risk that someone would assume the generateToken function to do this check.
Changing this behaviour will break some tests (e.g. application/backend/tests/integration/Survey.test.ts but that is easily fixed.
Please discuss any concerns below!
Currently
application/backend/src/authentication.tsdoes not check the provided UserID exists in the DB (as it is only called after a user is inserted or queried). I think it probably should - the cost of an extra db query may be probably worth the extra security. I see there is a risk that someone would assume thegenerateTokenfunction to do this check.Changing this behaviour will break some tests (e.g.
application/backend/tests/integration/Survey.test.tsbut that is easily fixed.Please discuss any concerns below!