Fix insecure password recovery (OWASP A04)

owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/ChangePassword.go

@@ -14,7 +14,7 @@ import (
 func ChangePassword(c echo.Context) (err error) {
 	user := c.Get("user").(*jwt.Token)
 	claims := user.Claims.(*services.JwtCustomClaims)
-	if claims.Recovery != true {
+	if claims.Recovery == true {
 		return c.JSON(http.StatusOK, echo.Map{
 			"message": "invalid token",
 		})

owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/RecoveryPassword.go

@@ -1,45 +1,11 @@
 package routes
 
-import (
-	"api/database"
-	"api/services"
-	"api/types"
-	"fmt"
-	"net/http"
-	"strings"
+import ("net/http"
 
 	"github.com/labstack/echo"
 )
-
 func RecoveryPassword(c echo.Context) (err error) {
-	u := new(types.RecoveryPasswordAnswers)
-	if err = c.Bind(u); err != nil {
-		return
-	}
-	u.Login = strings.ToLower(u.Login)
-	recoveryPasswordAnswers := types.RecoveryPasswordAnswers{
-		Login:        u.Login,
-		FirstAnswer:  u.FirstAnswer,
-		SecondAnswer: u.SecondAnswer,
-	}
-
-	answers, err := database.RecoveryPassword(recoveryPasswordAnswers.Login, recoveryPasswordAnswers.FirstAnswer, recoveryPasswordAnswers.SecondAnswer)
-	if err != nil {
-		return c.JSON(http.StatusConflict, echo.Map{"message": "incorrect answers!"})
-	}
-
-	if answers.FirstAnswer != recoveryPasswordAnswers.FirstAnswer || answers.SecondAnswer != recoveryPasswordAnswers.SecondAnswer {
-		return c.JSON(http.StatusConflict, echo.Map{"message": "incorrect answers!"})
-	}
-
-	token, err := services.GenerateJwt(recoveryPasswordAnswers.Login, true)
-	if err != nil {
-		return c.JSON(http.StatusUnauthorized, echo.Map{
-			"token": "Error to generate token.",
-		})
-	}
-	fmt.Println(token)
-	return c.JSON(http.StatusOK, echo.Map{
-		"token": token,
+	return c.JSON(http.StatusForbidden, echo.Map{
+		"message": "password recovery is disabled",
 	})
-}
+}

owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/User.go

@@ -1,30 +1,12 @@
 package routes
 
 import (
-	"api/database"
-	"api/types"
 	"net/http"
-	"strings"
-
 	"github.com/labstack/echo"
 )
 
 func UserInfo(c echo.Context) (err error) {
-	u := new(types.User)
-	if err = c.Bind(u); err != nil {
-		return
-	}
-	u.Login = strings.ToLower(u.Login)
-	userQuestions, err := database.UserQuestions(u.Login)
-	if err != nil {
-		return c.JSON(http.StatusBadRequest, echo.Map{
-			"message": "invalid login",
-		})
-	}
-
-	return c.JSON(http.StatusOK, echo.Map{
-		"login":          userQuestions.Login,
-		"firstQuestion":  userQuestions.FirstQuestion,
-		"secondQuestion": userQuestions.SecondQuestion,
+	return c.JSON(http.StatusForbidden, echo.Map{
+		"message": "user information is not available",
 	})
-}
+}

owasp-top10-2021-apps/a4/super-recovery-password/src/api/server.go

@@ -32,10 +32,8 @@ func main() {
 	}))
 
 	e.GET("/healthcheck", routes.Healthcheck)
-	e.POST("/userinfo", routes.UserInfo)
 	e.POST("/register", routes.Register)
 	e.POST("/login", routes.Login)
-	e.POST("/recovery", routes.RecoveryPassword)
 
 	r := e.Group("/reset")
 	config := middleware.JWTConfig{