login: gracefully handle bad login attempts.

4 years ago · 15cd41db83
parent 215a260700
commit 15cd41db83
1 changed files with 5 additions and 1 deletions
--- a/django_etesync/views.py
+++ b/django_etesync/views.py
@ -647,7 +647,11 @@ class AuthenticationViewSet(viewsets.ViewSet):
                    return Response(content, status=status.HTTP_400_BAD_REQUEST)

                verify_key = nacl.signing.VerifyKey(bytes(user.userinfo.loginPubkey), encoder=nacl.encoding.RawEncoder)
-                verify_key.verify(response_raw, signature)
+
+                try:
+                    verify_key.verify(response_raw, signature)
+                except nacl.exceptions.BadSignatureError:
+                    return Response({'code': 'login_bad_signature'}, status=status.HTTP_400_BAD_REQUEST)

                data = self.login_response_data(user)
                return Response(data, status=status.HTTP_200_OK)