Neilk1021 opened a new issue, #7977:
URL: https://github.com/apache/texera/issues/7977
### Feature Summary
Currently anyone can claim any email as their own when registering an
account; besides the obvious security concerns this also allows users to
mistype their email without knowing they did so. Therefore we should add a
standard OTP protocol to texera for deployments of Texera.
### Proposed Solution or Design
An email address a user types is proved by a code mailed to it before it is
accepted at registration, and when a signed-in account with no address on file
supplies one. An address a provider already asserts as verified (Google's
email_verified) is trusted and never re-checked.
Codes are derived from a 6-digit code as a truncated HMAC (RFC 4226 style)
over purpose | scope | address | time-step, keyed from the JWT secret, and
checks it by recomputing for the current and previous step.
```
register(user, email, pw) ──> derive code ──> mail it ──> 200, no account yet
│
registerVerify(user, email, pw, code)
│
recompute & compare ──> account + token
```
See also: #7818
### Affected Area
Hub
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
