fix: send otp in email link #379

kangmingtay · 2022-02-08T06:47:50Z

What kind of change does this PR introduce?

Fixes Email Confirm and Password reset via code #139, Send code instead of magic link #264, Email client previewing links expires confirmation/reset/invite tokens #368
Sends the OTP (which can either be a confirmation / invite / recovery / email change token) in the email together with the url link
Developers can choose to omit {{ .ConfirmationURL }} from their email templates to prevent cases where email clients preview the URL thus resulting in the token being consumed. (addresses Email client previewing links expires confirmation/reset/invite tokens #368)

API Additions / Changes

POST /verify now accepts an email field which would be used together with the token to verify the user.

{
  "type": "signup",
  "email": "foo@example.com",
  "token": "random token",
  "redirect_to": "my_redirect_to_url"
}

If type=email_change and MAILER_SECURE_EMAIL_CHANGE_ENABLED=true, the old email will be used for verifying both OTPs sent to the old and new email address.

Implementation Details

I refactored the common parts in signupVerify, recoverVerify, emailChangeVerify and smsVerify into a new function called verifyUserAndToken
verifyUserAndToken does the following:
- Checks if the verification is an url or otp verification
- If it's an otp verification, check if its an sms or email otp.
Checks if the user is banned
Checks if the otp is valid

To-Dos:

Allow url link / otp expiration to be configurable rather than restricted to 24hrs
Send a human-readable hash / slug instead of an otp (will be added as an enhancement in a separate PR)

J0

Looks fine to me. But let me sleep on it and read once more before approving

api/verify_test.go

J0 · 2022-02-10T02:44:37Z

api/verify.go

+	return time.Now().Before(expiresAt) && (actual == expected)
+}
+
+func isUrlVerification(params *VerifyParams) bool {


/nit Would be nice if we could check directly params.Type == URLVerification instead of via exclusion (e.g. it is not (email or sms) so it is url)

That said, it is not a priority and would require a refactor. Probably not within a scope of this PR.

Yeah i thought about that too but the type (signup vs recover) is tightly coupled to the ConfirmationToken & RecoveryToken fields, so it would be hard to tell whether the URL is a confirmation or recovery URL if we introduced a params.Type == URLVerification

J0

Looks great! Thanks for the PR :)

awalias

I may have overlooked it, but do we have a test case for: valid token used in combination with the email address of a different user?

api/verify.go

kangmingtay · 2022-02-10T06:30:00Z

I may have overlooked it, but do we have a test case for: valid token used in combination with the email address of a different user?

yeah i can add a test for that too, in this case, the verification should be rejected because the valid token doesn't belong to that user.

github-actions · 2022-02-10T07:50:19Z

🎉 This PR is included in version 2.5.8 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

asyncink · 2022-02-17T18:13:20Z

Hi guys and thank you for your work! Can you please provide some information about your plans to support email OTP in supabase-js client? @J0

This aligns the connection handling behaviour with the rest of the functions in `api/verify.go`. This looks like it might have been a leftover bug during refactoring in PR supabase#379.

…424) This aligns the connection handling behaviour with the rest of the functions in `api/verify.go`. This looks like it might have been a leftover bug during refactoring in PR #379.

vbylen · 2022-05-07T23:43:38Z

This is awesome @kangmingtay.

Now the OTP code sent looks like this:

pLPxtiXsMC_D7hQqhuLQDw

Unfortunately that's too long to copy manually.

Especially on mobile that doesn't add much benefit over redirects.

Instead an example code should look like this:

234 432

That way, a user could type it manually from the email notification they receive, and not have to close the app.

I'm not sure how much of a headache it is to implement this, but it's the standard on most other services.

kangmingtay · 2022-05-09T08:09:11Z

hey @vbylen, with this PR (#446), the email codes are now in the following format: ycjho-qjvns-nadyy-kcpbu which would be much easier for the user to either copy manually or type it manually since they are divided into even chunks.

vbylen · 2022-05-11T04:04:04Z

great job @kangmingtay

Now if it was possible to replace it with just 6 digits like in two-factor authentication... 😄

zebaroni · 2022-06-21T18:46:01Z

ycjho-qjvns-nadyy-kcpbu Is not easy at all for a user to copy...

vbylen · 2022-06-25T09:01:33Z

@bicijay agreed, this was a missed opportunity

@kiwicopple thoughts?

kangmingtay · 2022-06-25T10:31:21Z

@bicijay @vbylen we're working on a PR to shorten the email otp to [6-10] digits long, thanks for the feedback everyone!

kaaloo · 2022-09-02T13:43:02Z

Is there any ongoing work on this @kangmingtay ?

@bicijay @vbylen we're working on a PR to shorten the email otp to [6-10] digits long, thanks for the feedback everyone!

J0 · 2022-09-02T16:01:12Z

Hey @kaaloo,

The work by @kangmingtay to shorten the email otp to 6-10 digits has been merged. Do check out the/generate_link endpoint on the README and let us know if you have any questions.

Thanks!

* fix: send otp in email links * fix: allow verifying otps from emails * add tests for email_change verification * fix: add env var to configure email link / token expiry * docs: update README * fix: verify phone & email before fetching user * add test for invalid email otp

…upabase#424) This aligns the connection handling behaviour with the rest of the functions in `api/verify.go`. This looks like it might have been a leftover bug during refactoring in PR supabase#379.

* fix: send otp in email links * fix: allow verifying otps from emails * add tests for email_change verification * fix: add env var to configure email link / token expiry * docs: update README * fix: verify phone & email before fetching user * add test for invalid email otp

…upabase#424) This aligns the connection handling behaviour with the rest of the functions in `api/verify.go`. This looks like it might have been a leftover bug during refactoring in PR supabase#379.

* fix: send otp in email links * fix: allow verifying otps from emails * add tests for email_change verification * fix: add env var to configure email link / token expiry * docs: update README * fix: verify phone & email before fetching user * add test for invalid email otp

…upabase#424) This aligns the connection handling behaviour with the rest of the functions in `api/verify.go`. This looks like it might have been a leftover bug during refactoring in PR supabase#379.

fix: send otp in email links

3f5e6e8

kangmingtay force-pushed the km/send-code-in-email branch from 6bf63b8 to 7d2a125 Compare February 8, 2022 06:54

fix: allow verifying otps from emails

352d36b

kangmingtay force-pushed the km/send-code-in-email branch from 7d2a125 to 352d36b Compare February 8, 2022 06:55

kangmingtay added 3 commits February 8, 2022 16:10

add tests for email_change verification

c82b148

fix: add env var to configure email link / token expiry

0b943a5

docs: update README

ba1e686

kangmingtay requested review from awalias and J0 February 9, 2022 09:54

kangmingtay changed the title ~~[WIP] fix: send otp in email link~~ fix: send otp in email link Feb 9, 2022

fix: verify phone & email before fetching user

99c2375

kangmingtay force-pushed the km/send-code-in-email branch from a82ff9c to 99c2375 Compare February 9, 2022 10:55

J0 reviewed Feb 9, 2022

View reviewed changes

J0 reviewed Feb 10, 2022

View reviewed changes

api/verify_test.go Outdated Show resolved Hide resolved

J0 reviewed Feb 10, 2022

View reviewed changes

J0 approved these changes Feb 10, 2022

View reviewed changes

awalias approved these changes Feb 10, 2022

View reviewed changes

api/verify.go Show resolved Hide resolved

api/verify.go Show resolved Hide resolved

kangmingtay added 2 commits February 10, 2022 15:14

Merge branch 'master' into km/send-code-in-email

10b08c6

add test for invalid email otp

449cc50

kangmingtay merged commit f853f45 into master Feb 10, 2022

kangmingtay deleted the km/send-code-in-email branch February 10, 2022 07:49

github-actions bot added the released label Feb 10, 2022

kangmingtay mentioned this pull request Mar 17, 2022

fix: add verify email otp to verifyOTP supabase/auth-js#251

Merged

bnjmnt4n mentioned this pull request Mar 23, 2022

fix: re-use existing connection's transaction in emailChangeVerify #424

Merged

kangmingtay mentioned this pull request Jun 25, 2022

fix: shorten email otp length #513

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: send otp in email link #379

fix: send otp in email link #379

kangmingtay commented Feb 8, 2022 •

edited

Loading

J0 left a comment

J0 Feb 10, 2022 •

edited

Loading

kangmingtay Feb 10, 2022

J0 left a comment

awalias left a comment

kangmingtay commented Feb 10, 2022

github-actions bot commented Feb 10, 2022

asyncink commented Feb 17, 2022

vbylen commented May 7, 2022

kangmingtay commented May 9, 2022

vbylen commented May 11, 2022

zebaroni commented Jun 21, 2022

vbylen commented Jun 25, 2022

kangmingtay commented Jun 25, 2022

kaaloo commented Sep 2, 2022

J0 commented Sep 2, 2022

fix: send otp in email link #379

fix: send otp in email link #379

Conversation

kangmingtay commented Feb 8, 2022 • edited Loading

What kind of change does this PR introduce?

API Additions / Changes

Implementation Details

To-Dos:

J0 left a comment

Choose a reason for hiding this comment

J0 Feb 10, 2022 • edited Loading

Choose a reason for hiding this comment

kangmingtay Feb 10, 2022

Choose a reason for hiding this comment

J0 left a comment

Choose a reason for hiding this comment

awalias left a comment

Choose a reason for hiding this comment

kangmingtay commented Feb 10, 2022

github-actions bot commented Feb 10, 2022

asyncink commented Feb 17, 2022

vbylen commented May 7, 2022

kangmingtay commented May 9, 2022

vbylen commented May 11, 2022

zebaroni commented Jun 21, 2022

vbylen commented Jun 25, 2022

kangmingtay commented Jun 25, 2022

kaaloo commented Sep 2, 2022

J0 commented Sep 2, 2022

kangmingtay commented Feb 8, 2022 •

edited

Loading

J0 Feb 10, 2022 •

edited

Loading