History

Simon Backx e7378520a0 🔒 Prevented member creation when logging in (#15526 ) fixes https://github.com/TryGhost/Ghost/issues/14508 This change requires the frontend to send an explicit `emailType` when sending a magic link. We default to `subscribe` (`signin` for invite only sites) for now to remain compatible with the existing behaviour. Problem: When a member tries to login and that member doesn't exist, we created a new member in the past. - This caused the creation of duplicate accounts when members were guessing the email address they used. - This caused the creation of new accounts when using an old impersonation token, login link or email change link that was sent before member deletion. Fixed: - Trying to login with an email address that doesn't exist will throw an error now. - Added new and separate rate limiting to login (to prevent user enumeration). This rate limiting has a higher default limit of 8. I think it needs a higher default limit (because it is rate limited on every call instead of per email address. And it should be configurable independent from administrator rate limiting. It also needs a lower lifetime value because it is never reset. - Updated error responses in the `sendMagicLink` endpoint to use the default error encoding middleware. - The type (`signin`, `signup`, `updateEmail` or `subscribe`) is now stored in the magic link. This is used to prevent signups with a sign in token. Notes: - Between tests, we truncate the database, but this is not enough for the rate limits to be truly reset. I had to add a method to the spam prevention service to reset all the instances between tests. Not resetting them caused random failures because every login in every test was hitting those spam prevention middlewares and somehow left a trace of that in those instances (even when the brute table is reset). Maybe those instances were doing some in memory caching.		2022-10-05 12:42:42 +02:00
..
lib	🔒 Prevented member creation when logging in (#15526 )	2022-10-05 12:42:42 +02:00
test	Updated Eslint ECMAScript compatibility to 2022	2022-08-09 15:51:40 +02:00
.eslintrc.js
index.js
package.json	Update Test & linting packages	2022-10-05 00:36:08 +00:00
README.md

README.md

Magic Link

Usage

const crypto = require('crypto');
const nodemailer = require('nodemailer');
const MagicLink = require('@tryghost/magic-link');

async function main() {
    const jwtSecret = crypto.randomBytes(16).toString('hex');

    // https://nodemailer.com/about/#example
    const testAccount = await nodemailer.createTestAccount();

    const transporter = nodemailer.createTransport({
        host: 'smtp.ethereal.email',
        port: 587,
        secure: false, // true for 465, false for other ports
        auth: {
            user: testAccount.user, // generated ethereal user
            pass: testAccount.pass // generated ethereal password
        }
    }, {
        from: '"Your App" <signin@example.com>',
        subject: 'Whatever'
    });

    const service = MagicLink({
        tokenProvider: new MagicLink.JWTTokenProvider(jwtSecret),
        transporter,
        getSigninURL(token) {
            return `http://example.com/signin?token=${token}`
        }
    });

    /**
     *  POST /signin
     */
    const {url, info} = await service.sendMagicLink({
        email: 'test@example.com',
        tokenData: {
            id: 'some-id'
        }
    });

    // https://nodemailer.com/about/#example
    // Preview only available when sending through an Ethereal account
    console.log('Preview URL: %s', nodemailer.getTestMessageUrl(info));
    // Preview URL: https://ethereal.email/message/WaQKMgKddxQDoou...

    /**
     *  GET /signin
     */
    const data = await service.getDataFromToken(token);
    // createSomeKindOfSession(user);
}

main();