From a7437fbb00912046694397114009e8b390c82499 Mon Sep 17 00:00:00 2001 From: anshul23102 Date: Tue, 2 Jun 2026 22:49:35 +0530 Subject: [PATCH] fix(auth): return HTTP 401 for invalid login credentials instead of 200 Fixes #279 The login controller returned res.json(...) with no status code on both failure paths (user not found and password mismatch), which defaults to HTTP 200 OK. Security middleware, CDN caches, and client interceptors that inspect status codes would treat a failed login as a successful request, breaking standard error-handling patterns. Changed both failure returns to res.status(401).json(...) so the HTTP status code accurately reflects the authentication outcome. --- backend/controllers/auth.controller.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/controllers/auth.controller.js b/backend/controllers/auth.controller.js index 7dd531f..18a889e 100644 --- a/backend/controllers/auth.controller.js +++ b/backend/controllers/auth.controller.js @@ -18,11 +18,11 @@ async function login(req, res, next) { const { email, password } = req.body; const user = await User.findOne({ email }); if (!user) { - return res.json({ loginStatus: false, Error: 'Invalid Credentials' }); + return res.status(401).json({ loginStatus: false, Error: 'Invalid Credentials' }); } const match = await bycrypt.compare(password, user.password); if (!match) { - return res.json({ loginStatus: false, Error: 'Invalid Credentials' }); + return res.status(401).json({ loginStatus: false, Error: 'Invalid Credentials' }); } const token = jwt.sign({ id: user._id, email: user.email }, process.env.JWT_SECRET, { expiresIn: '1d' }); res.cookie('token', token, cookieOptions);