Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Registering without a password returns a 500 instead of telling you what is missing

Open Beginner friendly
  • Is something wrong?
#191 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
express, typescript
Domain
api, authentication, backend

Research direction

Start in apps/http-server/src/controllers/authController.ts and compare the register handler with the login handler's required-field check. Add coverage for missing and empty fields, then verify the curl example returns 400 naming the missing field and that valid registration still works. The issue also suggests checking quizController and inviteController for similar request body validation gaps.

Written by the indexing model from the issue text.

Description

Backend first issue bug good first issue help wanted

The register handler reads the body and goes straight to work:

// apps/http-server/src/controllers/authController.ts
export const userRegisterController = async (req: Request, res: Response) => {
    try {
        const { name, email, password } = req.body;

        const isUserExisted = await prisma.user.findUnique({ where: { email } })
        if (isUserExisted) return errorResponse(res, 400, "Email is already existed..")

        const hashedPassword = await bcrypt.hash(password, 10);   // throws when undefined

There is no presence check, so a missing field reaches bcrypt.hash(undefined, 10), which throws into the catch and returns a generic 500.

Confirmed against the live API:

POST /api/v1/auth/register  {"name":"t","email":"..."}     # no password
→ 500 {"success":false,"error":"Internal Server Error..."}

The sibling login handler in the same file already does it right:

if (!email || !password) return errorResponse(res, 400, "All fields are required...");
Why it matters

A 500 says "the server is broken". A 400 says "you forgot the password". Anyone integrating with the API, or debugging a form that failed to send a field, is sent looking in the wrong place entirely — and 500s are what you page on, so this also adds noise to any error monitoring.

What a fix looks like

The smallest version is the same guard login uses. Better, since zod ^4.3.6 is already a dependency: validate the shape properly and say which field is wrong, not just that something is.

Worth checking the other controllers for the same gap while you are there — quizController and inviteController have endpoints that read req.body directly too. If you find more, mention them in the PR; fixing them all in one change is fine as long as the description lists them.

Definition of done
curl -X POST .../api/v1/auth/register -H "Content-Type: application/json" -d "{\"email\":\"[email protected]\"}"
# → 400, naming the missing field
  • No request with a missing or empty field can reach bcrypt.hash
  • A valid registration still works exactly as before

Good first issue: a few lines, with a working example of the right pattern directly above it in the same file.

Dominant language
TypeScript
Stars
21
Forks
7
Avg merge
3h 39m
Merged PRs (30d)
16

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from TheCodeHeist-Coder/Rexial

All issues in TheCodeHeist-Coder/Rexial

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.