This is not secure and won't work as is since it will let you send an email and post a comment as any user you want since it only checks the from address which can be anything the user wants -- there needs to be unique keys per user that GItea already knows or can calculate in order to verify a message.

Github does this that each issue/pull has a unique ID for each user and that is included in the reply-to address in order to verify a comment (which require sub addressing) like Reply-To: go-gitea/gitea <reply+AAMXTQ7FKLLONE4ER6KUPGN5X5TCJEVBNHHXHSI8HW@reply.github.com>.

Gitlab has a second option that if you can't create random/unique reply to addresses you can put the unique value in side the "References" header which most (but not all) mail programs will include in the reply.

This is not secure and won't work as is since it will let you send an email and post a comment as any user you want since it only checks the from address which can be anything the user wants -- there needs to be unique keys per user that GItea already knows or can calculate in order to verify a message.

Github does this that each issue/pull has a unique ID for each user and that is included in the reply-to address in order to verify a comment (which require sub addressing) like Reply-To: go-gitea/gitea <reply+AAMXTQ7FKLLONE4ER6KUPGN5X5TCJEVBNHHXHSI8HW@reply.github.com>.

Gitlab has a second option that if you can't create random/unique reply to addresses you can put the unique value in side the "References" header which most (but not all) mail programs will include in the reply.

Ok, Thanks. I see, I not use in-reply-to because many mail service not use the message-id set by user, they will generate their's own, but set other heads (for example X-Microsoft-Original-Message-ID).
But I forgot References, maybe it's usefull, for secure, we should generate an uniq password and append it on the email to send and check it when recived emails. (like unsubscribe link in gh https://github.com/notifications/unsubscribe-auth/xxxxxxxxF7WKGXAPCJNxxxxxxM4TXINDYQ)

some usefull message in RFC 2822
https://tools.ietf.org/html/rfc2822

When creating a reply to a message, the "In-Reply-To:" and
   "References:" fields of the resultant message are constructed as
   follows:

   The "In-Reply-To:" field will contain the contents of the "Message-
   ID:" field of the message to which this one is a reply (the "parent
   message").  If there is more than one parent message, then the "In-
   Reply-To:" field will contain the contents of all of the parents'
   "Message-ID:" fields.  If there is no "Message-ID:" field in any of
   the parent messages, then the new message will have no "In-Reply-To:"
   field.

   The "References:" field will contain the contents of the parent's
   "References:" field (if any) followed by the contents of the parent's
   "Message-ID:" field (if any).  If the parent message does not contain
   a "References:" field but does have an "In-Reply-To:" field
   containing a single message identifier, then the "References:" field
   will contain the contents of the parent's "In-Reply-To:" field
   followed by the contents of the parent's "Message-ID:" field (if
   any).  If the parent has none of the "References:", "In-Reply-To:",
   or "Message-ID:" fields, then the new message will have no
   "References:" field.

Codecov Report

Merging #13585 (b00df2e) into master (0c0445c) will decrease coverage by 0.11%.
The diff coverage is 20.09%.

@@            Coverage Diff             @@
##           master   #13585      +/-   ##
==========================================
- Coverage   41.84%   41.73%   -0.12%     
==========================================
  Files         744      748       +4     
  Lines       79779    80212     +433     
==========================================
+ Hits        33387    33476      +89     
- Misses      40874    41211     +337     
- Partials     5518     5525       +7     

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c0445c...b00df2e. Read the comment docs.

Codecov Report

❗ No coverage uploaded for pull request base (main@d2163df). Click here to learn what that means.
The diff coverage is 11.08%.

@@           Coverage Diff           @@
##             main   #13585   +/-   ##
=======================================
  Coverage        ?   45.29%           
=======================================
  Files           ?      802           
  Lines           ?    89344           
  Branches        ?        0           
=======================================
  Hits            ?    40465           
  Misses          ?    42372           
  Partials        ?     6507           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d2163df...5589c19. Read the comment docs.

I'm not sure what's the status of this PR, but if subadressing is not available and headers are not preserved, it is always possible to include the token in the title of the email, it is preserved by all clients I guess (at most they will append some texts like "Re")