Skip to content

Add input validation to server actions for security #69

@coderabbitai

Description

@coderabbitai

Description

Server actions handling sensitive user data (email, password) currently lack proper input validation, relying only on client-side validation which can be bypassed.

Affected Files

  • apps/web/src/app/signup/action.ts
  • apps/web/src/app/signin/action.ts
  • apps/web/src/app/reset/action.ts

Security Concern

The current implementation uses type casting without validation:

  • Email format validation is missing
  • Password complexity requirements are not enforced server-side
  • Input sanitization is not performed

This creates a security vulnerability where malformed or malicious input could be processed.

Context

This issue was identified during code review and acknowledged with a comment in the code stating 'in practice, you should validate your inputs' but the validation is not implemented.

References

Metadata

Metadata

Labels

Projects

Status

In Progress

Relationships

None yet

Development

No branches or pull requests

Issue actions