When using SSO, send user email notification upon app password creation
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Is your feature request related to a problem? Please describe.
A person leaves an online session unattended and an attacker creates secretly an app password. Later, the attacker can download most data of the user at any time from any place.
Describe the solution you'd like
10 minutes after the app password creation (so that the attacker does not see the notification to delete it immediately), the user receives an email notification about the app password creation with a proposition to review/revoke the app passwords in case they have not created the password themselves.
Describe alternatives you've considered
I have not considered alternatives. For those who do not require app passwords, it would be also nice to disable user app password creation altogether. I believe this alternative was already brought up in another issue, but cannot find it currently.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing app password creation and the existing authentication and email-notification flows. Determine how SSO-created passwords are identified, how a delayed notification and review/revoke path should work, and define tests for notification timing and recipient behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100