You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I recently had to work on an auth solution using Firebase Password-less authentication which is why I'm curious to raise this question about Veil:
If you look at Firebases' security concerns they suggest that the verification string should always be accompanied by the email address at the time of sign in:
To prevent a sign-in link from being used to sign in as an unintended user or on an unintended device, Firebase Auth requires the user's email address to be provided when completing the sign-in flow. For sign-in to succeed, this email address must match the address to which the sign-in link was originally sent.
I'm curious what you think about this requirement and whether that's something Veil should support?
The text was updated successfully, but these errors were encountered:
armanm
changed the title
Should Veil expect the email address along with the Base32 encoded request id to complete authentication?
Should Veil expect the email address along with the verification string to complete authentication?
Jul 15, 2020
I recently had to work on an auth solution using Firebase Password-less authentication which is why I'm curious to raise this question about Veil:
If you look at Firebases' security concerns they suggest that the verification string should always be accompanied by the email address at the time of sign in:
I'm curious what you think about this requirement and whether that's something Veil should support?
The text was updated successfully, but these errors were encountered: