search

revoltchat / backend

Monorepo for Revolt backend services.
https://developers.revolt.chat/api/
Other
1.13k stars 125 forks source link

Prevent unverified accounts from logging if verification link has not been clicked. #126

Closed davidmroth closed 1 year ago

davidmroth commented 2 years ago

When `` is enabled, user are still able to login even before the login and email is verified (via email)

Steps to reproduce:

  1. Enable REVOLT_USE_EMAIL_VERIFICATION=1 & REVOLT_UNSAFE_NO_EMAIL=0
  2. Register - user will be notified that an email has been sent
  3. Goto login page and login before email is verified
  4. User is able to login

An upstream (rauth) pull request created that resolves the issue: https://github.com/insertish/rauth/issues/32

After changes in pull request, users will need to verify email before being able to login. If not, user will receive a login error:

image

insertish commented 1 year ago

This was fixed.