Cannot set header after they are sent to the client

Question

I'm developing a login attempt counter and getting the error Cannot set header after they are sent to the client. The problem occurs when executing the first and second "else if" condition. When adding:

.json({
  status: "failure",
  message: ""
});

to the response and executing the code by clicking the login button on my vue frontend to trigger the condition. The last condition is totally fine and giving me no error even tho it's the same response.

if (
  (lastTry[0].Time - firstTry[0].Time > 15000 && valid) ||
  (attempts[0].total <= 3 && valid)
) {
  console.log("DELETING AND LOGGING IN");
  await db.query("DELETE FROM loginattempts WHERE username=?", [
    req.body.username
  ]);
  await db.query("INSERT INTO loginattempts SET ?", [data]);

  let user = new User(compareUser[0]);
  const token = jwt.sign(
    {
      user
    },
    nconf.get("jwtToken"),
    {
      expiresIn: "14d"
    }
  );
  Object.assign(user, {
    token
  });
  res.json(user);
  // Check if period of time is over and if login attempt was not successful. Or if number of attempts is valid and login was not successfull.
  // If so, delete list of attempts and write current one back
} else if (lastTry[0].Time - firstTry[0].Time > 10000 && !valid) {
  console.log("DELETING AND NOT LOGGING IN");
  await db.query("DELETE FROM loginattempts WHERE username=?", [
    req.body.username
  ]);
  await db.query("INSERT INTO loginattempts SET ?", [data]);
  res.sendStatus(403).json({
    status: "failure",
    message: ""
  });
  // Check if attempts are fine and login was not successfull and push it to database
} else if (attempts[0].total < 3 && !valid) {
  // await db.query('INSERT INTO loginattempts SET ?', [data]);
  res.sendStatus(403).json({
    status: "failure",
    message: ""
  });
} else if (
  lastTry[0].Time - firstTry[0].Time < 10000 /*1800000*/ &&
  attempts[0].total > 3
) {
  // Check if difference of last and first login attempt is bigger than half an hour and for maximum of 3 login attempts during that period of time
  console.log("Wait half an hour!");
  res.status(403).json({
    status: "tooManyAttempts",
    message:
      "Zu viele Login-Versuche! Bitte in einer halben Stunde erneut probieren..."
  });
}

Answer 1

The problem is with sendStatus(). Note the two differences below:

• status() sets a HTTP status on the response (as a Javascript object on the server side).
• sendStatus() sets the status and sends it to the client.

Now the right way for you to do is replace all the sendStatus() with status().

Here's an updated code:

if (
  (lastTry[0].Time - firstTry[0].Time > 15000 && valid) ||
  (attempts[0].total <= 3 && valid)
) {
  console.log("DELETING AND LOGGING IN");
  await db.query("DELETE FROM loginattempts WHERE username=?", [
    req.body.username
  ]);
  await db.query("INSERT INTO loginattempts SET ?", [data]);

  let user = new User(compareUser[0]);
  const token = jwt.sign(
    {
      user
    },
    nconf.get("jwtToken"),
    {
      expiresIn: "14d"
    }
  );
  Object.assign(user, {
    token
  });
  res.json(user);
  // Check if period of time is over and if login attempt was not successful. Or if number of attempts is valid and login was not successfull.
  // If so, delete list of attempts and write current one back
} else if (lastTry[0].Time - firstTry[0].Time > 10000 && !valid) {
  console.log("DELETING AND NOT LOGGING IN");
  await db.query("DELETE FROM loginattempts WHERE username=?", [
    req.body.username
  ]);
  await db.query("INSERT INTO loginattempts SET ?", [data]);
  res.status(403).json({
    status: "failure",
    message: ""
  });
  // Check if attempts are fine and login was not successfull and push it to database
} else if (attempts[0].total < 3 && !valid) {
  // await db.query('INSERT INTO loginattempts SET ?', [data]);
  res.status(403).json({
    status: "failure",
    message: ""
  });
} else if (
  lastTry[0].Time - firstTry[0].Time < 10000 /*1800000*/ &&
  attempts[0].total > 3
) {
  // Check if difference of last and first login attempt is bigger than half an hour and for maximum of 3 login attempts during that period of time
  console.log("Wait half an hour!");
  res.status(403).json({
    status: "tooManyAttempts",
    message:
      "Zu viele Login-Versuche! Bitte in einer halben Stunde erneut probieren..."
  });
}