search

decred / politeiagui

ISC License
62 stars 56 forks source link

Invalid signature when updating identity. #2841

Closed lukebp closed 2 years ago

lukebp commented 2 years ago

Multiple users have reported issues with updating their identity. We were finally able to figure out the reproduction steps.

  1. User clicks the "Create new identity" button. The gui creates a new identity and the server sends a verification email.
  2. Prior to verifying the identity, the user clicks the "Create new identity" button again. The gui mistakenly creates another new identity and overwrites the first unverified identity. The server returns a "verification email has already been sent" error.
  3. Now when the user tries to verify the original identity using the link emailed to them, they'll get a invalid signature error because the wrong identity is being used to sign the verification token.