Added check if the Google OAuth account has e-mail verified flag #152
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Changes !== false to !== true to fail closed if verification field is missing, null, or false. Prevents bypass attacks.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
| } | ||
|
|
||
| // If we get here, the check passed | ||
| return { verified: true, provider } |
There was a problem hiding this comment.
Bug: OAuth Email Verification Bypass
The isOAuthEmailVerified function's default case for OAuth providers marks emails as verified without any actual check. This means users from unhandled providers are considered verified even if their email isn't, creating a security vulnerability.
|
|
||
| // Check email verification only for new users (signup) | ||
| // Existing users with linked identities can sign in with any provider | ||
| const isNewUser = data.user.identities?.length === 1 |
There was a problem hiding this comment.
Bug: OAuth Users Blocked by Incorrect New User Check
The isNewUser check, based on data.user.identities?.length === 1, incorrectly identifies existing users with a single OAuth identity as new. This subjects existing users to email verification checks, potentially blocking their sign-in if their OAuth provider's email verification status isn't met.
|
Agreed with Ben, we will not merge this in favor of possible other mitigations. |
2 participants
Summary
Implements email verification validation for OAuth providers during authentication callback. Users with unverified emails are rejected and signed out.
Changes
isOAuthEmailVerified()helper function to validate OAuth identity dataBehavior
email_verified) and GitHub (verified) providersTesting
Verified locally with Google OAuth. Logs confirm check executes on every OAuth authentication.
Note
Adds OAuth email verification at auth callback for new users, with provider-specific error handling and messages.
src/app/api/auth/callback/route.ts):isOAuthEmailVerified; treat users with a single identity as new.signOut, and redirect toAUTH_URLS.SIGN_INwith provider-specific error message fromUSER_MESSAGES.src/lib/utils/auth.ts):isOAuthEmailVerified(user)to check identity data (supportsgoogleviaemail_verifiedandgithubviaverified).src/configs/user-messages.ts):googleEmailNotVerified,githubEmailNotVerified,oauthEmailNotVerified, andgenericEmailNotVerifiedwith 30s timeouts.Written by Cursor Bugbot for commit 64f1a03. This will update automatically on new commits. Configure here.