payloadcms / payloadcms/website
Registration of new user using Temporary mail should not be allowed
Open
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 634
- Forks
- 195
- Avg merge
- 11h 43m
- Merged PRs (30d)
- 17
Description
The current authentication system allows users to register and log in using temporary/disposable email addresses. This presents a security and abuse concern, as malicious users can exploit this loophole to create multiple fake accounts, bypass rate limiting, or avoid accountability.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no file, test, or entry point; first locate the registration and authentication flow and review existing account-abuse protections. Done should be demonstrated by tests showing disposable addresses cannot register or log in while normal addresses still work.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100