do not hide registration errors (login/email already used)

relates to #21731
jhipster · Oct 22, 2023 · d6df316 · d6df316
1 parent 1da7aa1
commit d6df316
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 13 deletions.
diff --git a/...ors/server/templates/src/main/java/_package_/web/rest/errors/ExceptionTranslator.java.ejs b/...ors/server/templates/src/main/java/_package_/web/rest/errors/ExceptionTranslator.java.ejs
@@ -149,13 +149,10 @@ _%>
 
     private ProblemDetailWithCause getProblemDetailWithCause(Throwable ex) {
 <%_ if (!skipUserManagement) { _%>
-        if(ex instanceof <%= packageName %>.service.EmailAlreadyUsedException ||
-            ex instanceof <%= packageName %>.service.UsernameAlreadyUsedException) {
-                // return 201 - CREATED on purpose to not reveal information to potential attackers
-                // see https://github.com/jhipster/generator-jhipster/issues/21731
-                return ProblemDetailWithCauseBuilder.instance()
-                    .withStatus(201).build();
-            }
+        if(ex instanceof <%= packageName %>.service.UsernameAlreadyUsedException ) 
+            return (ProblemDetailWithCause) new LoginAlreadyUsedException().getBody();    
+        if(ex instanceof <%= packageName %>.service.EmailAlreadyUsedException ) 
+            return (ProblemDetailWithCause) new EmailAlreadyUsedException().getBody();
         if(ex instanceof <%= packageName %>.service.InvalidPasswordException )
             return (ProblemDetailWithCause) new InvalidPasswordException().getBody();
 

diff --git a/generators/server/templates/src/test/java/_package_/web/rest/AccountResourceIT.java.ejs b/generators/server/templates/src/test/java/_package_/web/rest/AccountResourceIT.java.ejs
@@ -529,14 +529,14 @@ class AccountResourceIT {
             .contentType(MediaType.APPLICATION_JSON)
             .bodyValue(TestUtil.convertObjectToJsonBytes(secondUser))
             .exchange()
-            .expectStatus().isCreated();
+            .expectStatus().isBadRequest();
 <%_ } else { _%>
         restAccountMockMvc.perform(
             post("/api/register")
                 .contentType(MediaType.APPLICATION_JSON)
                 .content(TestUtil.convertObjectToJsonBytes(secondUser))<% if (authenticationUsesCsrf) { %>
                 .with(csrf())<% } %>)
-            .andExpect(status().isCreated());
+            .andExpect(status().is4xxClientError());
 <%_ } _%>
     }
 
@@ -632,14 +632,14 @@ class AccountResourceIT {
             .contentType(MediaType.APPLICATION_JSON)
             .bodyValue(TestUtil.convertObjectToJsonBytes(userWithUpperCaseEmail))
             .exchange()
-            .expectStatus().isCreated();
+            .expectStatus().is4xxClientError();
 <%_ } else { _%>
         restAccountMockMvc.perform(
             post("/api/register")
                 .contentType(MediaType.APPLICATION_JSON)
                 .content(TestUtil.convertObjectToJsonBytes(userWithUpperCaseEmail))<% if (authenticationUsesCsrf) { %>
                 .with(csrf())<% } %>)
-            .andExpect(status().isCreated());
+            .andExpect(status().is4xxClientError());
 <%_ } _%>
 
         Optional<<%= user.persistClass %>> testUser4 = userRepository.findOneByLogin("test-register-duplicate-email-3")<% if (reactive) { %>.blockOptional()<% } %>;
@@ -655,14 +655,14 @@ class AccountResourceIT {
             .contentType(MediaType.APPLICATION_JSON)
             .bodyValue(TestUtil.convertObjectToJsonBytes(secondUser))
             .exchange()
-            .expectStatus().isCreated();
+            .expectStatus().is4xxClientError();
 <%_ } else { _%>
         restAccountMockMvc.perform(
             post("/api/register")
                 .contentType(MediaType.APPLICATION_JSON)
                 .content(TestUtil.convertObjectToJsonBytes(secondUser))<% if (authenticationUsesCsrf) { %>
                 .with(csrf())<% } %>)
-            .andExpect(status().isCreated());
+            .andExpect(status().is4xxClientError());
 <%_ } _%>
     }