Email verification seem buggy + is deactivation possible ? #264
Replies: 3 comments 9 replies
-
Btw the error I'm getting that leads to "internal server error" on devices I was connected before the change is this. Any idea how to avoid this to my users ?
|
Beta Was this translation helpful? Give feedback.
-
Hi @arminvburren 👋
The cookie expires when the access token expires. So if the access token has a lifetime of 1 hour, the browser will remove the cookie at that time.
I've indeed identified cases where the form is submitted twice, leading to an error to the user, but the verification actually works behind the scenes.
Not currently, but I may consider it. The thing is, in terms of security, it's highly recommended to verify emails, that's why I decided in a first approach to make it mandatory. But I understand it's an opinionated choice that may not fit every use cases. |
Beta Was this translation helpful? Give feedback.
-
@frankie567 I might be holding it wrong but it seems that even for social login it requires an email. This is extremely inconvenient, and I'm not sure I see any value in it at all. Social login is so that the trusted social provider can provide the security and reliability to the user - as secondary users of this identity, we just need to know that the trusted provider knows who it is, and that we can uniquely identify the user. Some fief users might want extra info from the 3rd party provider, some don't. As a user's email is Personally Identifiable Information under European law, this also has important legal implications. Many users of fief don't actually need any PII and just need a convenient login mechanism, so you are forcing them to collect PII and create significant extra legal and security challenges. Many countries also don't really use email, and forcing users to validate one is a huge hassle. As an example, email really, really didn't take off in China (a huge proportion of business communication even goes via WeChat!), so many users will actually stop a signup process and not use your service if they have to validate an email address. Many online services, including those in the West (like MS), don't require an email, so you can sign up with just a phone number. In any case, that it what is happening for me with the Microsoft login - it is forcing email validation after I log in with MS. For the project I am working on I don't want PII (that requires significant extra hassle with university ethics approval), so that makes Fief a lot less useful than it would be. |
Beta Was this translation helpful? Give feedback.
-
Hello,
So I've seen there's a new version of fief which introduce email verification. I'm not too happy and I'll just share the few problems I've had with it:
First, on every device i was connected to my heroku apps through fief I've had an "Internal Server Error" for 2 weeks. It took me a while to understand it was coming from fief actually and I had to delete all my cookies and have to relogin to be able to the new fief version. This is a bit of a problem because I feel there's a possibility that RIGHT NOW all my users may be having the exact same problem right now and just can't access my websites if they were connected through fief on them. The bigger problem is that I can't debug it because now I'm connected with the new version so I can't see the error, and I don't know how to reach to them to explain they have to remove their fief cookies (if they understand what that evern means) if the only see they can see is the "Internal server error" on my websites. Is there a way to make their cookie expiring or disconnect all my users remotely so that can reconnect and access the websites again ?
Secondly the actual "verification code" process seem to just not be working. On my two websites where I've done the process to get MY access, I've literally copy pasted the code from the email to the 6 letter boxes, and EVERY TIME it said "wrong code or expired". That said, when I refreshed the websites I was actually connected. But that happend after I tried to do "resend the code", which actually took me to some other page to change the password or something, which is not what I wanted to do at all (and also the "previous" button had a really weird behaviour which didn't bring me back to the right place)
Thirdly, the bottom line is that I really don't need any kind of email verification, and I absolutely think it's an unnecessary hassle for my users. I don't see the point: no one has sensitive information on my websites and the accounts are here to improve user experience mostly. I actually though it was precisely great that fief enabled authentification without that kind of back and forth between email and website which is so common and annoying this days (not even mentioning the 2FA insanity I need to do just even speak on github where I have 0 code, or the 'saleforce authentificator' for heroku 🙄 ... ). Is there a way I can disable email verification on fief ? If that doesn't exist that would be an ABSOLUTELY welcomed feature from my side in the future (and even right now since the email verification flow seem still quite buggy.
Thanks again for the great library though in general.
Regards
Beta Was this translation helpful? Give feedback.
All reactions