Email Verification Not Reflected in Identities Table (and JWT)

Open
#1,620 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
go
Domain
authentication

Research direction

Start by reproducing the GET /verify flow and inspecting how email confirmation updates the users and identities tables and the JWT. Done means email_verified becomes true in identities and the resulting JWT reflects the verified email status.

Written by the indexing model from the issue text.

Description

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

When a user clicks on the email authentication link (causes a GET /verify request), the email_confirmed_at field gets updated in the users table and the one-time token gets cleared, but the email_verified field does not get changed to true in the identities table (and hence is not properly shown in the JWT).

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to 'Click on email authentication link'

  2. Observe the GET /verify request

  3. Check the users table and note that the email_confirmed_at field is updated and the one-time token is cleared.

  4. Check the identities table and note that the email_verified field is not updated to true.
    JWT does not reflect the email_verified status.

I was able to reproduce this on Supabase and on a self-hosted instance.

Expected behavior

The email_verified field in the identities table should be updated to true when the email is confirmed, and this should be properly reflected in the JWT.

Additional context

The ResourceServer cannot properly verify whether a users email address has been verified.

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.