Security: magic links are insecure and should instead ask the user to type a code sent by mail #38

New Issue

ashpie · 2021-06-02T16:42:35+02:00

ashpie commented

2021-06-02 16:42:35 +02:00

Magic links currently is subject to involuntary login in attackers.

Attacker request login
User accidentaly clicks on the link
Attacker is logged in as the user

Magic links currently is subject to involuntary login in attackers. 1. Attacker request login 2. User accidentaly clicks on the link 3. Attacker is logged in as the user

ashpie added this to the v0.24.0 milestone 2021-06-02 16:42:35 +02:00

ashpie added the

feature/enhancement

label 2021-06-02 16:42:35 +02:00

ashpie self-assigned this 2021-06-02 16:42:35 +02:00

ashpie modified the milestone from v0.24.0 to v0.26.0

2021-11-09 19:40:00 +01:00

Sign in to join this conversation.

No Label

No Milestone

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: ashpie/swaf#38