spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Bug] Join SpikerSoft signup accepts spaces in the username #254

New Issue
Closed
opened 2026-06-25 16:16:58 +00:00 by spikerj · 1 comment
spikerj commented 2026-06-25 16:16:58 +00:00
Owner
Copy Link
Copy Source

Severity

Medium — lets users create accounts with whitespace in their username, which is almost never valid downstream (login, URLs, Keycloak), and produces confusing availability checks.

Area

Registration stepper — Basic Info step ("Join SpikerSoft" flow), username field.

Bug

The username form control in the Basic Info step only validates required, minLength(5), and maxLength(50). There is no pattern constraint, so a new user can type a username containing spaces (e.g. john doe) and the form still considers it valid.

To make matters worse, the availability check calls checkUsernameAvailable(username.trim()), so the value sent to the backend is trimmed while the value stored on the form still contains the spaces — the displayed check result can disagree with what is actually submitted.

Steps to reproduce

  1. Open the "Join SpikerSoft" registration flow.
  2. In the Basic Info step, type a username that contains a space (e.g. john doe).
  3. Observe the field is accepted as valid and you can proceed.

Expected

Usernames must not contain spaces (or other whitespace). Invalid usernames should show a clear validation error and block proceeding to the next step.

Pointers

  • spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/basic-info-step.ts — username FormControl validators.
  • spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/basic-info-step.html — username mat-error messages.
  • i18n: registration.basicInfo.username* keys in assets/i18n/en.json / es.json.
## Severity Medium — lets users create accounts with whitespace in their username, which is almost never valid downstream (login, URLs, Keycloak), and produces confusing availability checks. ## Area Registration stepper — Basic Info step ("Join SpikerSoft" flow), username field. ## Bug The username form control in the Basic Info step only validates `required`, `minLength(5)`, and `maxLength(50)`. There is no pattern constraint, so a new user can type a username containing spaces (e.g. `john doe`) and the form still considers it valid. To make matters worse, the availability check calls `checkUsernameAvailable(username.trim())`, so the value sent to the backend is trimmed while the value stored on the form still contains the spaces — the displayed check result can disagree with what is actually submitted. ### Steps to reproduce 1. Open the "Join SpikerSoft" registration flow. 2. In the Basic Info step, type a username that contains a space (e.g. `john doe`). 3. Observe the field is accepted as valid and you can proceed. ### Expected Usernames must not contain spaces (or other whitespace). Invalid usernames should show a clear validation error and block proceeding to the next step. ## Pointers - `spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/basic-info-step.ts` — username `FormControl` validators. - `spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/basic-info-step.html` — username `mat-error` messages. - i18n: `registration.basicInfo.username*` keys in `assets/i18n/en.json` / `es.json`.
spikerj added the bug label 2026-06-25 16:16:58 +00:00
spikerj commented 2026-06-26 15:08:49 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-angular PR #76 (merged to master). Added a pattern validator (^[a-zA-Z0-9._-]+$) to the username control so spaces (and other disallowed characters) are rejected, with a matching translated error message in EN/ES. Closing.

Resolved in spikersoft-angular PR #76 (merged to `master`). Added a `pattern` validator (`^[a-zA-Z0-9._-]+$`) to the username control so spaces (and other disallowed characters) are rejected, with a matching translated error message in EN/ES. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#254