element-hq / element-hq/element-web
`force_verification` can be circumvented by poking the URL
Open
O-Uncommon
S-Minor
T-Defect
Team: Crypto
- Dominant language
- TypeScript
- Stars
- 13.5k
- Forks
- 2.8k
- PR merge metrics
- PR metrics pending
Description
### Steps to reproduce
1. Set `force_verification: true` in config.json
2. Log in a new session
3. Observe "Confirm your identity" modal
4. Change URL to `/#/room/!`
### Outcome
#### What did you expect?
No change
#### What happened instead?
App opens and is usable
Contributor guide
Assessment
This issue has not been assessed yet.