Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User able to change email with no verification - potential lockout risk with no reset option #1064

Open
pkparimi opened this issue May 31, 2022 · 0 comments

Comments

@pkparimi
Copy link
Contributor

Severity - (Medium)
Weakness - Violation of Secure Design Principles

Description
User is able to navigate to account settings and change email to any email in a proper email format (i.e. [email protected]). After clicking 'Save' and submitting the form, this email is now saved as their account email. Subsequently, there is no additional email verification needed unlike when a User signs up. This introduces a potential risk to the user in that they may be locked out of their account with no way to reset their password if the 'new' email is entered incorrectly. Based on the current design the 'updateUser' fuction called on submit here: https://github.com/tidepool-org/blip/blob/develop/app/redux/actions/async.js does not consist of any verification for any updates. At minimum, there should be a verification step when changing email

Steps To Reproduce:-

  1. Create a valid account
  2. Login to this account
  3. Navigate to 'Account Settings' by hitting top right button
  4. Change email to any validly formatted email
  5. Click 'Save' to submit
  6. Logout
  7. Try to log in - only the new 'unverified' email will work

Example
Original email - gmail.com used
Untitled1

Saved email that is a 'typo' - gmail.cb is not a valid email host
Untitled2

Logging in with original email does not work
Untitled3

Logging in with this 'typo' email does - with no verification step
Untitled4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant