Skip to content

Downcase email before using it to generate confirmation token

Eugie Limpin requested to merge el-fix-confirmation-token-generation into master

What does this MR do and why?

Resolves https://gitlab.com/gitlab-org/modelops/anti-abuse/team-tasks/-/issues/428

Problem:

  1. Before the user record is persisted, unlock_token is generated using the email (mixed case) entered by the user in the registration form
  2. Email is downcased when the user record is persisted
  3. User tries to use the confirmation token generated in (1) that is sent to their email
  4. Confirmation token sent to the user does not match the generated token generated using the persisted user's email (downcased)
  5. Identity verification fails

To fix the problem we downcase the unpersisted user's email before generating the confirmation token.

Screenshots or screen recordings

Before After
Screen_Recording_2023-08-04_at_4.11.56_PM Screen_Recording_2023-08-04_at_4.03.12_PM

How to set up and validate locally

Replicate

  1. Enable identity_verification FF
    $ rails console
    > FeatureFlag.enable(:identity_verification)
  2. Sign up using a mixed case email (e.g. myFancyEmail@example.com)
  3. Get the confirmation token from http://localhost:3000/rails/letter_opener/
  4. Validate that the identity verification (email) step succeeds

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Eugie Limpin

Merge request reports