From e5b7d55b9505a9499400e09def1adc57520f2043 Mon Sep 17 00:00:00 2001
From: Gerrit User 1039238 <1039238@d5d70762-12d0-45a1-890d-524b12d3f735>
Date: Sun, 1 Feb 2026 09:52:09 +0000
Subject: [PATCH] Create change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub Pull Request: https://github.com/bs-community/blessing-skin-server/pull/675

[Security] Dynamic Email Verification & Password Reset Links

 **Problem**
1. **Static Signature Vulnerability**:
   - Email verification links used a static signature algorithm (same link for lifetime), allowing account hijacking if links were leaked.
   - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account under danger.
2. **Overly Long Reset Window**:
   - Password reset links remained valid for 1 hour, enabling attackers to hijack accounts if intercepted.
   - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account account take over.

 **Solution**
- **Email Verification**:
  - Replaced static signatures with **HMAC-SHA256 + timestamp + nonce**.
  - Links are now **one-time-use** and expire immediately after verification.
- **Password Reset**:
  - Links are now **one-time-use** and expire immediately after verification.

 **Impact**
- **Closed Communities**: Critical for real-name systems (e.g., gaming, enterprise).
- **AppKey Leak Mitigation**: Even with leaked AppKey, intercepted links are now useless.

The commit message is translated by Deepseek due to my poor English. Please do pardon me.

Patch-set: 1
Change-id: I0dc85e3e0aca60876e54131288c53b3f18c75cd5
Subject: [Security] Dynamic Email Verification & Password Reset Links  **Problem** 1. **Static Signature Vulnerability**:    - Email verification links used a static signature algorithm (same link for lifetime), allowing account hijacking if links were leaked.    - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account under danger. 2. **Overly Long Reset Window**:    - Password reset links remained valid for 1 hour, enabling attackers to hijack accounts if intercepted.    - *Worst-case scenario*: Compromised AppKey + leaked link → full-site account account take over.
Branch: refs/heads/dev
Status: new
Topic:
Commit: 3d42aab16dd5b9a327171a24c2ddda0756e02340
Tag: autogenerated:gerrit:newPatchSet
Groups: 3d42aab16dd5b9a327171a24c2ddda0756e02340
Private: false
Work-in-progress: false