Skip to content

Disable automatic login feature when clicking on email confirmation links

Brian Neel requested to merge disable-automatic-login-on-email-confirmation into master

This is a patch for issue https://gitlab.com/gitlab-org/gitlab-ce/issues/24411.

GitLab automatically logs a user in when they click on an email confirmation link. This is dangerous as a stolen or sniffed confirmation token can be used to authenticate as that user without knowing a username or password.

This patch needs review as there is likely a reason this behavior was originally enabled.

@stanhu @MrChrisW

Edited by 🤖 GitLab Bot 🤖

Merge request reports