Create change

Browse Source

GitHub Pull Request: https://github.com/bs-community/blessing-skin-server/pull/676

修复邮箱验证链接安全问题

@shhzhang 发现当前邮箱验证链接存在以下安全问题：

1. 验证链接永不过期
2. 验证链接仅对用户ID进行了签名

其中问题2比较严重，如果用户在收到验证链接后故意不完成验证，又把邮箱改成其他任意邮箱，之前收到的验证链接仍然能继续使用，从而可以绑定任意邮箱。

#675 的修复似乎仅在签名中增加了时间戳，只解决了问题1，且修复方式较为复杂，本 PR 使用 `temporarySignedRoute` 进行修复。

Patch-set: 1
Change-id: If629a7e922ce67b18bd9c0453a948b52c3dabb09
Subject: fix: generate temporary email verification link with email hash included
Branch: refs/heads/dev
Status: new
Topic: 
Commit: ba3cc6fe91
Tag: autogenerated:gerrit:newPatchSet
Groups: ba3cc6fe91
Private: false
Work-in-progress: false

...

This commit is contained in:

Gerrit User 1039237 2026-02-01 09:52:06 +00:00 committed by Gerrit Code Review

commit 9a9f188c58

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Show Stats Download Patch File Download Diff File Expand all files Collapse all files

Diff Content Not Available