Force username & email to lowerCase PLUS Remove sensitive data before…

[almegdad]

… return authenticated user in password reset

[lirantal]

@rhutchison @codydaig @ilanbiala @mleanos any thoughts?

[lirantal]

We seem to have decided not to use the data- prefix for angular attributes so please change this through-out the PR to just ng-change and so on..

[rhutchison]

can we use css text-transform: lowercase; instead of ng-change, and then on save (client or server) transform to lower?

[mleanos]

I agree with @rhutchison that this should be done with the save method, either on the client or server side. I'm not a fan of using ng-change for these types of scenarios.

I don't see a need to transform with css. The real need here is to change the username to lowercase, sometime, before authentication; in order to decrease the chance of user error.

However, if the view must be updated to reflect the lowercase change, then I'd say that's an argument to do the conversion, in the client controller save method; thus, updating the view.

[mleanos]

After looking at these changes a bit further, I think the lowercase conversion should be done at the very front-end with the user input; most likely in the client controller method that initiates any API calls. If these changes are made in the middleware, they can get lost & the SOC gets weaker.

To ensure the username & email always get converted to lowercase, the pre-save hook can be used on the User model.

[rhutchison]

I don't see a need to transform with css. The real need here is to change the username to lowercase, sometime, before authentication; in order to decrease the chance of user error.

However, if the view must be updated to reflect the lowercase change, then I'd say that's an argument to do the conversion, in the client controller save method; thus, updating the view.

@mleanos Why wouldn't you just have text-transform? the user doesn't need to know when it's transformed, just that it is being transformed.

[mleanos]

@rhutchison I don't like using css as a means to transform data based on business logic/needs. The client/server controller would be sufficient in most cases. If someone wants to update the view to show the transformation, then adding the css text-transform would be an enhancement, IMO.

[ilanbiala]

.toLowerCase is good, but I'd do it in the JS and not in the HTML.

[simison]

Those ng-change bits could be removed; after that this LGTM and pretty much how I'm doing it already at my copy.

+1 @mleanos - CSS/angular frontend tweaking seems hacky.

I understand the sentiment tho; without it changing case sensitive input to lowercase at the backend comes as a surprise after hitting save. Changing text on the go while typing might be confusing as well.

Personally I'm saving displayUsername separately, much like displayName works, so users can keep their CamelCaseUsernames and no confusing UX.

[almegdad]

reopened #866