Team member invitation token hasn't email validator
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 624
Description
### Environment
SaaS (https://sentry.io/)
### Version
_No response_
### Steps to Reproduce
## Back-end side
Probably you have this logic
- Getting the invitation token, with the authorization token
- Authorize user with the authorization token
- validate invitation token (expired or not)
- add the current user to the team (depends on invitation token type)
It needs to add a step to check if the invitation link clicked by the user who can use the invitation token
Add email part to the token
before adding the user to the team, check if the authorized user email is the same email in the invitation token.
### Expected Result
The team member's invitation token hasn't email chunk to identify who is using the token
If the user has an account logged in with email X on some browser and opens the invitation link sent to Y email, it works, and add the user with X email to the team
### Actual Result
It needs to add a Y user to the team, not X.
Need to show exception page, or allow to log in multiple users in the browser, or just log out the current user.
Contributor guide
Assessment
This issue has not been assessed yet.