authgear / authgear-server

Open source alternative to Auth0 / Firebase Auth
https://www.authgear.com
Apache License 2.0
81 stars 37 forks source link

[Custom email provider] Username and password are not mandatory #1582

Open harry5858 opened 2 years ago

harry5858 commented 2 years ago

Device: Chrome on Mac Build: staging Description: Username and password are not mandatory, bug minor

Steps:

  1. Login
  2. Click into one of the projects
  3. Go to custom email provider
  4. Toggle use my own provider on
  5. Click SMTP provider
  6. See username and password field are not mandatory

Expected behaviour: Username and password field should be mandatory

Screenshot:

Screenshot 2021-10-11 at 6 13 46 PM

design:

Screenshot 2021-10-11 at 6 11 08 PM

stanleylhs commented 2 years ago

Cannot reproduce. Button disabled if fields are empty.

However, from my experience, authentication for SMTP is not strictly mandatory.

For example, for HKBN, they require no authentication as long as your IP address is a HKBN IP. From HKBN doc,

smtpo.hkbn.net is the server of SMTP server in HKBN. It is noted that it only runs if you are using HKBN’s internet connection.

So say someone self host a local Authgear instance in the intranet with a self hosted SMTP, that can work without SMTP authentication too?

Quick Googling and skimming RFC5321, the original SMTP doesn't seem to require authentication.

Suggest to add an Info tool-tip the inform user to check with their SMTP provider if they need authentication.

@fungc-io @louischan-oursky

louischan-oursky commented 2 years ago

Thanks for pointing out authentication is not mandatory! But most of the time username and password are required, let's wait until someone complains they do not want authentication.