Confirmation token can be re-used before it expires #86

stevepolitodesign · 2022-02-25T11:13:36Z

rails-authentication-from-scratch/app/models/user.rb

Line 57 in b3e253f

signed_id expires_in: CONFIRMATION_TOKEN_EXPIRATION, purpose: :confirm_email

Issues

stevepolitodesign/rails_mvp_authentication#54

Closes stevepolitodesign#86. The issue is that signed tokens have a simple payload by default that doesn't verify anything other than the record id and the token's purpose. This can lead to a security challenge as the token can be used to confirm anything that has the same "purpose" for that record. An example would be someone changing their email address to an email address that they don't control. Using one account, they change the email to an email address that they control and get the confirmation token. They then change the email to one that they can't access and use the token from the first request to "confirm" the second request. The tokens can be used any number of times as long as they're used before expiration. With this change, the email address is included as plain text in the request, as well as being used as part of the "purpose" in the token. The second request fails because the plain text email address is used to constrain the signed lookup. If they change the plain text email address in the link then the message will fail to be validated as the "purpose" won't match. Either way, the token is usable only for confirming the original email from the token's creation.

stevepolitodesign self-assigned this Feb 25, 2022

stevepolitodesign removed their assignment Mar 17, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Confirmation token can be re-used before it expires #86

Confirmation token can be re-used before it expires #86

stevepolitodesign commented Feb 25, 2022

Confirmation token can be re-used before it expires #86

Confirmation token can be re-used before it expires #86

Comments

stevepolitodesign commented Feb 25, 2022

Issues