From 7d1b90a5bed5d6fc19c607f09c336047f66645b8 Mon Sep 17 00:00:00 2001 From: Stephen Adamson Date: Thu, 4 Jun 2026 12:02:39 +0100 Subject: [PATCH] fix(auth): lowercase referral code before validation and lookup Defense-in-depth: referral codes are generated as hex (lowercase only) by the DB. The frontend already lowercases on input, but direct API calls with uppercase would fail the DB lookup. Normalize to lowercase on the backend to prevent capslock situations. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- backend/handlers/auth/local.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/handlers/auth/local.go b/backend/handlers/auth/local.go index 0cfdf9b..dd88af9 100644 --- a/backend/handlers/auth/local.go +++ b/backend/handlers/auth/local.go @@ -177,7 +177,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) { // Validate referral code if provided var referrerID *string - req.ReferralCode = strings.TrimSpace(req.ReferralCode) + req.ReferralCode = strings.ToLower(strings.TrimSpace(req.ReferralCode)) if req.ReferralCode != "" { if len(req.ReferralCode) != 12 { http.Error(w, "referral code must be exactly 12 characters", http.StatusBadRequest)