Return 403 if totp token is invalid

the ui redirects to login screen otherwise
2019-03-23 14:07:37 -07:00
parent 0190a92c26
commit ee76c2c06e
5 changed files with 5 additions and 4 deletions
--- a/src/routes/notifications.js
+++ b/src/routes/notifications.js
@@ -20,7 +20,7 @@ function verifyOwnership(req, res, next) {
        if (error && error.reason === NotificationsError.NOT_FOUND) return next(new HttpError(404, 'No such notification'));
        if (error) return next(new HttpError(500, error));

-        if (result.userId !== req.user.id) return next(new HttpError(401, 'Unauthorized'));
+        if (result.userId !== req.user.id) return next(new HttpError(403, 'User is not owner'));

        req.notification = result;