For a course on securing APIs I'm not sure why the login method would tell a would be attacker what they got wrong. The error message for both conditional branches (not found and compare failed) should be "Authentication failed.". You're only taking in two pieces of information; an email address and a password, when you say tell the would be attacker that the user cannot be found you're providing them a mechanism to probe for registered accounts which they can then use in social engineering attacks, spam, etc.
Node.js: Securing RESTful APIs
With Emmanuel Henri
Liked by 796 users
Duration: 58m
Skill level: Advanced
Released: 2/6/2020
Course details
Skills you’ll gain
Meet the instructor
Learner reviews
Contents
What’s included
- Practice while you learn 1 exercise file
- Learn on the go Access on tablet and phone