Miroslav Šedivý 23d8a2718e oauth: ignore email when provider reports email_verified=false. ...

An unverified email could match admin_emails/user_emails on providers that
let users set their own email. Only an explicit false is rejected; providers
that omit the claim are still trusted. Document the behavior.

Reported-by: Zachariah Mithani <zachariah@aplosai.com> (AploSec)

2026-10-28 17:05:56 +01:00

..

config.go

feat: implement user email restrictions for OAuth login

2026-09-24 00:17:58 +02:00

provider.go

oauth: separate provider & service.

2026-09-24 00:16:23 +02:00

service.go

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

utils_test.go

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00

utils.go

oauth: ignore email when provider reports email_verified=false.

2026-10-28 17:05:56 +01:00