diff --git a/src/services/loginService.ts b/src/services/loginService.ts index 0e7fa5d4..7d1a7dd5 100644 --- a/src/services/loginService.ts +++ b/src/services/loginService.ts @@ -71,7 +71,21 @@ export const getAccountForRequest = async (req: Request): Promise => { - return (await getAccountForRequest(req))._id.toString(); + if (!req.query.accountId) { + throw new Error("Request is missing accountId parameter"); + } + if (!req.query.nonce || parseInt(req.query.nonce as string) === 0) { + throw new Error("Request is missing nonce parameter"); + } + if ( + !(await Account.exists({ + _id: req.query.accountId, + Nonce: req.query.nonce + })) + ) { + throw new Error("Invalid accountId-nonce pair"); + } + return req.query.accountId as string; }; export const isAdministrator = (account: TAccountDocument): boolean => {