From b3e2c58bcb8682c31e6ac82745de33440248fdf9 Mon Sep 17 00:00:00 2001
From: Alexander Blair <alex@snipanet.com>
Date: Wed, 15 Feb 2017 19:22:06 -0800
Subject: [PATCH] Update to return a 401 on invalid.

---
 lib/api.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/api.js b/lib/api.js
index f1e0907..f7b910a 100644
--- a/lib/api.js
+++ b/lib/api.js
@@ -438,7 +438,7 @@ app.post('/authenticate', function (req, res) {
     let hmac = crypto.createHmac('sha256', global.config.api.secKey).update(req.body.password).digest('hex');
     global.mysql.query("SELECT * FROM users WHERE username = ? AND ((pass IS null AND email = ?) OR (pass = ?))", [req.body.username, req.body.password, hmac]).then(function (rows) {
         if (rows.length === 0) {
-            return res.json({'success': false, msg: 'Invalid username/password'});
+            return res.status(401).send({'success': false, msg: 'Invalid username/password'});
         }
         let token = jwt.sign({id: rows[0].id, admin: rows[0].admin}, global.config.api.secKey, {expiresIn: '1d'});
         return res.json({'success': true, 'msg': token});