Miroslav Šedivý 23d8a2718e oauth: ignore email when provider reports email_verified=false. ...

An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.

Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)

2026-10-28 17:05:56 +01:00

..

file

rename package to github name.

2025-03-26 23:51:19 +01:00

multiuser

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

noauth

server: sanitised session ids, chat length limit, websocket read limit, leaky frame queues (#712)

2026-10-07 23:09:43 +02:00

oauth

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

object

rename package to github name.

2025-03-26 23:51:19 +01:00

manager.go

feat(auth): add OIDC-only member authentication (#686)

2026-09-24 00:15:46 +02:00