ExpressAPI/src/controllers/Session.ts

-import { getReasonPhrase } from 'http-status-codes';
+import { getReasonPhrase, StatusCodes } from 'http-status-codes';
 import * as jwt                         from 'jsonwebtoken';
 import { JwtPayload }                   from 'jsonwebtoken';
 import Config                           from '../config/Config';
@@ -22,7 +22,7 @@ class Session {
 
     constructor() { }
 
-    async initSession(req: express.Request) {
+    async initSession(req: express.Request, res: express.Response) {
         const authorization = req.headers.authorization;
         if ( authorization ) {
             if ( authorization.startsWith('Bearer ') ) {
@@ -35,7 +35,9 @@ class Session {
                         this.profile = jwtData.profile;
                         this.profile = await UserManager.getById(this.profile.id!) ?? this.profile;
                     }
-                } catch ( err ) { }
+                } catch ( err ) {
+                    res.sendStatus(StatusCodes.UNAUTHORIZED).end();
+                }
             }
         }
     }

ExpressAPI/src/managers/GitlabManager.ts

@@ -18,22 +18,27 @@ class GitlabManager {
         return `${ Config.gitlab.apiURL }${ route }`;
     }
 
-    private async getGitlabUser(paramToSearch: string | number, paramName: string): Promise<GitlabUser | undefined> {
+    public async getUserById(id: number): Promise<GitlabUser | undefined> {
         try {
             const params: any = {};
-            params[paramName] = paramToSearch;
-            return (await axios.get<Array<GitlabUser>>(this.getApiUrl(GitlabRoute.USERS_GET), { params: params })).data[0];
+            const user = (await axios.get<GitlabUser>(`${ this.getApiUrl(GitlabRoute.USERS_GET) }/${ String(id) }`, { params: params })).data;
+
+            return user.id === id ? user : undefined;
         } catch ( e ) { }
 
         return undefined;
     }
 
-    public async getUserById(id: number): Promise<GitlabUser | undefined> {
-        return await this.getGitlabUser(id, 'id');
-    }
-
     public async getUserByUsername(username: string): Promise<GitlabUser | undefined> {
-        return await this.getGitlabUser(username, 'search');
+        try {
+            const params: any = {};
+            params['search'] = username;
+            const user = (await axios.get<Array<GitlabUser>>(this.getApiUrl(GitlabRoute.USERS_GET), { params: params })).data[0];
+
+            return user.username === username ? user : undefined;
+        } catch ( e ) { }
+
+        return undefined;
     }
 
     async getRepository(idOrNamespace: string): Promise<GitlabRepository> {

ExpressAPI/src/middlewares/SessionMiddleware.ts

@@ -6,7 +6,7 @@ class SessionMiddleware {
     register(): (req: express.Request, res: express.Response, next: express.NextFunction) => void {
         return async (req: express.Request, res: express.Response, next: express.NextFunction) => {
             req.session = new Session();
-            await req.session.initSession(req);
+            await req.session.initSession(req, res);
 
             return next();
         };