RFC: How to handle email updates about gotrue-js HOT 4 CLOSED

PR here: #58

from gotrue-js.

Hello, maybe this isn't an issue anymore but after looking around I've found that gotrue reset new_email to '' only after confirmation, which is then omitted on serialization.
Also maybe this is expected behavior as unconfirmed email doesn't seem to enable sign-in?

from gotrue-js.

Hi all! I don't suppose there is any progress on this one? I noticed there were a few conflicts on the PR #58 which was from a while back. Ideally, I've love to be able to update the user's email directly without using the new_email field which I think requires the user to validate before it gets added as the user's actual email. Thanks!

from gotrue-js.

Hey everyone, updating a user's email requires at least a single confirmation from the user. The typical flow is as follows:

1. User logs in
2. User updates email via PUT /user
3. Gotrue sends a confirm email change link to the new_email
4. User clicks on confirm email change link by logging into the new_email address provided

The new_email field indicates the email that the user wants to update to. Maybe we should consider renaming it if it seems confusing.

Ideally, I've love to be able to update the user's email directly without using the new_email field which I think requires the user to validate before it gets added as the user's actual email.

@markwcollins user validation is a necessary security feature for email updates. A malicious user can potentially call the email update endpoint, change the user's email to theirs and perform a password reset action which sends a password reset link to the update email address.

Closing this for now but feel free to reopen it if i've misunderstood the issue.

from gotrue-js.