-
Notifications
You must be signed in to change notification settings - Fork 1.5k
[PM-31394] use email address hash for send access email verification #6921
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[PM-31394] use email address hash for send access email verification #6921
Conversation
|
Great job! No new security vulnerabilities introduced in this pull request |
|
There are a few tests still failing. Am working on fixing them today |
|
Would you mind putting in your description a recording of the send functionality that has been changed still working? |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #6921 +/- ##
==========================================
- Coverage 56.06% 56.06% -0.01%
==========================================
Files 1969 1969
Lines 87065 87067 +2
Branches 7755 7755
==========================================
- Hits 48817 48813 -4
- Misses 36439 36446 +7
+ Partials 1809 1808 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
src/Identity/IdentityServer/RequestValidators/SendAccess/SendEmailOtpRequestValidator.cs
Show resolved
Hide resolved
JaredSnider-Bitwarden
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!

🎟️ Tracking
https://bitwarden.atlassian.net/browse/PM-31394
📔 Objective
The email address used to obtain an email OTP for a send that uses email verification is being rejected by the identity server. The reason is because the identity server is using the plain text email address value against a list of hashed email addresses during the auth process
This change is related to the recent changes that the Tools Team made to ensure that we were not storing email lists in plain text on the server side for the send access feature
📸 Screenshots
This is a successful walkthrough of the email verification feature on my local dev env after the fix in this PR...
email_verification_example.mov
⏰ Reminders before review
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes