Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't Confirm By Code Using api #671

Open
memetrusidovski opened this issue Dec 11, 2024 · 0 comments
Open

Can't Confirm By Code Using api #671

memetrusidovski opened this issue Dec 11, 2024 · 0 comments

Comments

@memetrusidovski
Copy link

When using

ACCOUNT_EMAIL_VERIFICATION_BY_CODE_ENABLED = True

the api endpoint /dj-rest-auth/registration/verify-email/ doesent allow you to confirm email addresses by code unless you have the sessionid of the person that did the signup. This works fine if the user signs up and confirms in the same browser but if one signs up in lets say instagram then goes to their email to confirm the api endpoint blocks them. Im assuming it has to do with all-auth using sessionid but I have not been able to find out how to prevent it. I tried setting HMAC to false but it doesnt work either.

ACCOUNT_EMAIL_CONFIRMATION_HMAC = False

Even trying to write my own confirm does not work. I cant confirm the keys

from allauth.account.models import EmailConfirmationHMAC
from rest_framework.views import APIView
from rest_framework.permissions import AllowAny
from rest_framework.response import Response
from rest_framework import status

class CustomEmailConfirmationView(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        key = request.data.get('key')
        confirmation = EmailConfirmationHMAC.from_key(key)
        
        if not confirmation:
            return Response({'detail': 'Invalid confirmation key'}, status=status.HTTP_400_BAD_REQUEST)
        
        try:
            confirmation.confirm(request)
            return Response({'detail': 'Email confirmed successfully'}, status=status.HTTP_200_OK)
        except Exception as e:
            return Response({'detail': 'Confirmation failed'}, status=status.HTTP_400_BAD_REQUEST)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant