Generator-jhipster: REST API user management, regex on login too restrictive

[flam182]

Overview of the issue

If you want to edit the anonymousUser (default user) you have this error :
No message available

It's because the regex in the rest api is too restrictive on the login

@RequestMapping(value = "/users/{login:[_'.@a-z0-9-]+}",

Angular can't get the user information

JHipster version

Jhipster 3.0 version

Entity configuration(s) entityName.json files generated in the .jhipster directory

No entity

Browsers and Operating System

Chrome

Suggest a Fix

A correction would be in UserRessource.java file
@RequestMapping(value = "/users/{login:[_'.@a-zA-Z0-9-]+}",

But in the front, they must have a similar regex control

Or another solution is to remove the regex on the login in the REST API

[ruddell]

The regex for a User's login is also set in UserDTO

[wmarques]

What's the point of doing a regex for this ? Shouldn't we only do a regex to validate the username in the registration ?

[jdubois]

The regexp is because there is an issue with Spring MVC if you use a "." -> that's because if you call "user.json", Spring MVC by default will send you the user in JSON format. The issue is when your username is "julien.dubois"....
At the moment the regexp validates also that the username is in lowercase, but indeed this is isn't useful.
So this looks good to me, can you do a PR?

[wmarques]

I did this here but I've got a problem : when I try to login with a capslocked user, like USERTEST, it throws me a 401 error bad credentials but I'm sure that I'm using the right ones and i couldn't find where this come from...

[wmarques]

@jhipster/developers if someone has an idea I can work on it :)

[ruddell]

@wmarques I tested your branch with the development database set to mysql and it worked, but it doesn't work with h2disk. I looked into it and it's because H2's select statements are case-sensitive and we get the user from the database by lowercase login instead of the original (code link). I removed the .toLowerCase() and it works.

As a side note, all of the register form translations will need to be updated.

[wmarques]

@ruddell Thanks for finding this one, I'm fixing this :)

[wmarques]

So now it's fully working but I think it's strange to have case-sensitives logins.. Now we can have users with the same name, I don't think it's a common way of doing but maybe I'm wrong ?

[ruddell]

Adding a user repository method findOneByLoginIgnoreCase is one option that would work for every database type, I agree we shouldn't let multiple accounts have the same username with different casing.

Or add anonymousUser as an exception to every regex like in User.java (don't know if this would work).

[deepu105]

@wmarques I think we should be having case insensitive users only. Thats how its normally done. I should be able to login irrespective of the case i use in username and we shouldnt allow creation of two accounts with same name.

[wmarques]

@ruddell @deepu105 So should we lowercase all logins before db registration ? (except anonymousUser)

[deepu105]

@wmarques that might be a good idea

[wmarques]

I think it's better adding anonymousUser in regexp and have the same regexp everywhere.
And asking user to put a lowercased login (what we actually do) makes sense to me, instead of lowercasing the login ourselves.
So here I just updated the regexp, if it's ok I will PR this