Check if the password changed when user is not null

7 months ago · 87b2e45fbf
parent 9b599ccd1d
commit 87b2e45fbf
1 changed files with 5 additions and 5 deletions
--- a/server/server.js
+++ b/server/server.js
@ -318,12 +318,12 @@ let needSetup = false;
                    decoded.username,
                ]);

-                // Check if the password changed
-                if (decoded.h !== shake256(user.password, SHAKE256_LENGTH)) {
-                    throw new Error("The token is invalid due to password change or old token");
-                }
-
                if (user) {
+                    // Check if the password changed
+                    if (decoded.h !== shake256(user.password, SHAKE256_LENGTH)) {
+                        throw new Error("The token is invalid due to password change or old token");
+                    }
+
                    log.debug("auth", "afterLogin");
                    afterLogin(socket, user);
                    log.debug("auth", "afterLogin ok");