Description
In backend/controllers/chat.controller.js, the sendMessage handler reads the username field from the request body and stores it in Supabase without any server-side identity verification:
const { text, username, image, audio } = req.body;
const { data, error } = await supabase
.from('messages')
.insert([{ text, username, image, audio, status: 'sent' }])
.select();Although the route requires authenticateUser, the authenticated user's identity is never applied to the stored message. Any authenticated user can provide username: "other_person" in the request body to post chat messages under a different user's name.
To Reproduce
- Authenticate as User A.
- Send
POST /api/messages with { "text": "Hello team", "username": "UserB" }.
- The message is broadcast and stored as if UserB sent it.
Expected Behavior
The username should come from the authenticated session, not the request body. If the auth middleware attaches req.user:
const username = req.user?.username || req.user?.email || 'Anonymous';
Actual Behavior
Any authenticated user can send messages attributed to any arbitrary username.
Desktop
- Backend: Node.js / Express / Supabase
- File:
backend/controllers/chat.controller.js, function: sendMessage
Additional context
Expected NSOC points: level2 (security - identity impersonation)
Labels: bug, NSoC'26, level2
Checklist:
Description
In
backend/controllers/chat.controller.js, thesendMessagehandler reads theusernamefield from the request body and stores it in Supabase without any server-side identity verification:Although the route requires
authenticateUser, the authenticated user's identity is never applied to the stored message. Any authenticated user can provideusername: "other_person"in the request body to post chat messages under a different user's name.To Reproduce
POST /api/messageswith{ "text": "Hello team", "username": "UserB" }.Expected Behavior
The username should come from the authenticated session, not the request body. If the auth middleware attaches
req.user:Actual Behavior
Any authenticated user can send messages attributed to any arbitrary username.
Desktop
backend/controllers/chat.controller.js, function:sendMessageAdditional context
Expected NSOC points: level2 (security - identity impersonation)
Labels:
bug,NSoC'26,level2Checklist: