search

readthedocs / readthedocs.org

The source code that powers readthedocs.org
https://readthedocs.org/
MIT License
7.93k stars 3.58k forks source link

allauth: require re-authentication for some actions #11345

Open stsewd opened 1 month ago

stsewd commented 1 month ago

What's the problem this feature will solve?

Allauth has some cool feature that asks the user to re-authenticate when doing some operations, like changing email etc, this improves security for some actions that may be dangerous.

Describe the solution you'd like

Set ACCOUNT_REAUTHENTICATION_REQUIRED to true, and use the reauthentication_required on some views that are important, like adding owners or deleting a project.

humitos commented 2 weeks ago

I found this issue related to https://github.com/readthedocs/readthedocs-corporate/issues/969, that talks about requiring a verified email to perform some actions.

ericholscher commented 2 weeks ago

I notice that Stripe does this sometimes, and it makes sense. I'd probably set ACCOUNT_REAUTHENTICATION_TIMEOUT to something like ~30 minutes, so folks can perform a few admin actions without getting multiple login prompts.