[low] OIDC: email_verified trusted for the mail fallback; raw email in logs; OIDC ignores REGISTRATION_ENABLED #42

New issue

Open

opened 2026-10-18 17:46:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 17:46:55 +00:00

Owner

Found by Nye reviewing PR #37 (#11). Non-blocking, low.

handle_successful_auth falls back to user_info["mail"] when the "email" claim is missing, but email_verified only vouches for the "email" claim. In Accounts.find_or_create_oidc_user's linking path, only trust email_verified when the email came from "email" (e.g. pass email_verified: nil when the mail fallback was used).
The :email_taken warning logs the raw email address (PII, same family as #15).
(From Nye's #38 review) OIDC sign-in still creates new accounts when registration is disabled: the OIDC path never checks registration_enabled?. Fine if the IdP is the gate; decide whether REGISTRATION_ENABLED=false should also stop new OIDC users, or note it in the release notes.

Found by Nye reviewing PR #37 (#11). Non-blocking, low. 1. `handle_successful_auth` falls back to `user_info["mail"]` when the `"email"` claim is missing, but `email_verified` only vouches for the `"email"` claim. In `Accounts.find_or_create_oidc_user`'s linking path, only trust `email_verified` when the email came from `"email"` (e.g. pass `email_verified: nil` when the `mail` fallback was used). 2. The `:email_taken` warning logs the raw email address (PII, same family as #15). 3. (From Nye's #38 review) OIDC sign-in still creates new accounts when registration is disabled: the OIDC path never checks `registration_enabled?`. Fine if the IdP is the gate; decide whether `REGISTRATION_ENABLED=false` should also stop new OIDC users, or note it in the release notes.

jfro added the

low

main

security

labels

2026-10-18 17:46:55 +00:00

jfro referenced this issue

2026-10-18 17:59:26 +00:00

fix: make only the very first user admin, add REGISTRATION_ENABLED #38