Repository navigation
Update Email flow
#15858
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I've recently experimented new Update Email feature and it is really an improvement over what was available before. And wanted to highlight few privacy and security issues that still exist.
While changing email, everyone can make a typo or mistake by providing wrong email, which may be someone else valid email.
If mistake was spotted and user provided correct email on 2nd try, original action token is still valid and potentially someone can be the first to click this link, capturing account.
Things become worse if user decides to keep current email. This is possible by submitting old email value that is currently saved in user profile. But action token, sent originally to wrong email is still valid (up to expiration), so user is not protected from someone exercising this token.
Privacy of update email action tokens: action tokens are signed JWTs, so all claims can be extracted and original email too.
1st group of issues can be resolved, if Keycloak will be requiring re-login before executing "update email" action token, in this case user, that received the link by mistake won't be able to use it without knowing credentials.
2nd issue can be mitigated by using Encrypted JWT instead of Signed.
All reactions