Language: Go
Label: vulnerable
CWE: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Code:
func AccountPostLogin(w http.ResponseWriter, r *http.Request) {
	account, err := (&models.Account{Context: ctx.Context}).FromBody(r)
	if err != nil {
		ctx.HandleStatus(w, r, err.Error(), http.StatusBadRequest)
		return
	}

	var a1 = &models.Account{Context: ctx.Context}
	a1.FromData(account)
	a1, err = a1.Get()
	if err != nil {
		ctx.HandleStatus(w, r, err.Error(), http.StatusBadRequest)
		return
	}

	account, err = a1.ValidatePassword(account.Password, "Password")
	if err != nil {
		ctx.HandleStatus(w, r, "Invalid username or password!", http.StatusForbidden)
		return
	}

	session, err := (&models.Session{Context: ctx.Context, Unique: account.Unique}).Post()
	if err != nil {
		ctx.HandleStatus(w, r, err.Error(), http.StatusBadRequest)
		return
	}

	expiry := time.Now().Add(time.Hour * 15) // TODO: Change this once we've implemented refreshing
	SetAuthCookie(w, types.CookieSessionID, session.Key.ID.String(), expiry)
	SetAuthCookie(w, types.CookieRefreshToken, session.Refresh, expiry)

	ctx.HandleJson(w, r, account.CopyPublic(), http.StatusOK)
}