Changed 2fa delete from body to query for code

as per best practices
This commit is contained in:
Jamie Curnow
2026-01-14 13:24:38 +10:00
parent d33bb02c74
commit c1ad7788f1
5 changed files with 28 additions and 56 deletions

View File

@@ -370,16 +370,16 @@ router
})
/**
* DELETE /api/users/123/2fa
* DELETE /api/users/123/2fa?code=XXXXXX
*
* Disable 2FA for a user
*/
.delete(async (req, res, next) => {
try {
const { code } = await apiValidator(
getValidationSchema("/users/{userID}/2fa", "delete"),
req.body,
);
const code = typeof req.query.code === "string" ? req.query.code : null;
if (!code) {
throw new errs.ValidationError("Missing required parameter: code");
}
await internal2FA.disable(res.locals.access, req.params.user_id, code);
res.status(200).send(true);
} catch (err) {