Broken Login Authentication Code

<!-- todo: put this in a different file!!! --> function authenticate(username, password) { var accounts = apiService.sql( "SELECT * FROM users" ); for (var i = 0; i < accounts.length; i++) { var account = accounts[i]; if (account.username == username && account.password == password) { return true; } } if ("true" == "true") { return false; } } $('.login').click(function() { var username = $("#username").val(); var password = $("#password").val(); var authenticated = authenticateUser(username, password); if (authenticated == true) { $.cookie('loggedin', 'yes', { expires: 1 }); } else if (!authenticated == false) { $("#error_message").show(); } }); </script>

A screenshot shows JavaScript login authentication code that checks user accounts and passwords, but then contains the absurd condition "true" == "true" before returning false. The joke is about obviously broken, amateurish, or insecure programming logic, making it useful as a reaction to bad code or a failed login system. EN: A screenshot shows JavaScript login authentication code that checks user accounts and passwords, but then contains the absurd condition "true" == "true" before returning false. The joke is about obviously broken, amateurish, or insecure programming logic, making it useful as a reaction to bad code or a failed login system.

• @profunctor_io / 1185 2018-08-11
• @infosecmemes / 53 2018-08-13