src/services/loginService.ts

@@ -71,7 +71,21 @@ export const getAccountForRequest = async (req: Request): Promise<TAccountDocume
 };
 
 export const getAccountIdForRequest = async (req: Request): Promise<string> => {
-    return (await getAccountForRequest(req))._id.toString();
+    if (!req.query.accountId) {
+        throw new Error("Request is missing accountId parameter");
+    }
+    if (!req.query.nonce || parseInt(req.query.nonce as string) === 0) {
+        throw new Error("Request is missing nonce parameter");
+    }
+    if (
+        !(await Account.exists({
+            _id: req.query.accountId,
+            Nonce: req.query.nonce
+        }))
+    ) {
+        throw new Error("Invalid accountId-nonce pair");
+    }
+    return req.query.accountId as string;
 };
 
 export const isAdministrator = (account: TAccountDocument): boolean => {