Hello guys! During testing auth flow, i found an issue If i try to fill password field with this value

' or 1=1--

I get CORS error and page fall into infinite loading, till user reload the page Could you check this case pls? And its happening on each envs, not only on locallhost

Hi @Rustam Alekpierov , As I understand here you once face CORS error when you pass

' or 1=1--

password, Else your flow is working fine not getting CORS error.

Correct

Thanks for the confirmation. Let me check.

it’s not a CORS error really, the request to

v1/flow/start

was rejected (due to the suspected sqli) so you never got the CORS headers - which resulted in CORS error but the root cause here is the failed request to

/v1/flow/start

Fix for this should be handled on our side? Is yes - pls tell me how it should be done Thanks

it’s being blocked by our security controls, you were hoping to get an error in the flow? or did you expect to be able to use

' or 1=1--

as a password?

I was expecting to see a clear error message when the request is blocked, instead of infinite page loading. Thanks!