Skip to content

Commit

Permalink
small fix
Browse files Browse the repository at this point in the history
  • Loading branch information
rishabhpoddar committed Jun 11, 2024
1 parent b5e6977 commit 3f801fa
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 54 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -254,24 +254,7 @@ The following is a list of support status codes that the end user might see duri


### ERR_CODE_003
- This can happen during the passwordless recipe's create or consume code API (during sign in):
- API path and method: `/signinup/code POST` or `/signinup/code/consume POST`
- Output JSON:
```json
{
"status": "SIGN_IN_UP_NOT_ALLOWED",
"reason": "Cannot sign in / up due to security reasons. Please try a different login method or contact support. (ERR_CODE_003)"
}
```
- The pre build UI on the frontend displays this error in the following way:
<img src="/img/account-linking/err_003.png" alt="Pre built UI screenshot showing error message for ERR_CODE_003." style={{
height: "400px"
}}/>

- Below is as example scenario for when this status is returned (one amongst many):
A malicious user has a passwordless account with email `e1`. The victim has an email password login method with `e2`, which is verified. Both of these are non primary users since you have account linking switched off. Then you switch on automatic account linking. Now the attacker somehow changes their email to `e2` (via a support ticket perhaps), but it's in an unverified state. In this case, when the attacker enters email `e2` in the passwordless login box, this error code will show up. We do this because if we didn't, then the attacker might send a magic link to `e2`, and if the victim clicks on it, then the attacker's account will be linked to the victim's account. Even though the attacker won't be able to login to that account again, linking a potentially malicious account to a victim's account is not a good idea.

- To resolve this issue, you either mark the unverified account as verified, or then delete that particular login method / account. **You can do these actions using our user management dashboard.**
This used to be an error code, which is no longer valid and can be ignored.

### ERR_CODE_004
- This can happen during the thirdparty recipe's signinup API (during sign in):
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -254,24 +254,7 @@ The following is a list of support status codes that the end user might see duri


### ERR_CODE_003
- This can happen during the passwordless recipe's create or consume code API (during sign in):
- API path and method: `/signinup/code POST` or `/signinup/code/consume POST`
- Output JSON:
```json
{
"status": "SIGN_IN_UP_NOT_ALLOWED",
"reason": "Cannot sign in / up due to security reasons. Please try a different login method or contact support. (ERR_CODE_003)"
}
```
- The pre build UI on the frontend displays this error in the following way:
<img src="/img/account-linking/err_003.png" alt="Pre built UI screenshot showing error message for ERR_CODE_003." style={{
height: "400px"
}}/>

- Below is as example scenario for when this status is returned (one amongst many):
A malicious user has a passwordless account with email `e1`. The victim has an email password login method with `e2`, which is verified. Both of these are non primary users since you have account linking switched off. Then you switch on automatic account linking. Now the attacker somehow changes their email to `e2` (via a support ticket perhaps), but it's in an unverified state. In this case, when the attacker enters email `e2` in the passwordless login box, this error code will show up. We do this because if we didn't, then the attacker might send a magic link to `e2`, and if the victim clicks on it, then the attacker's account will be linked to the victim's account. Even though the attacker won't be able to login to that account again, linking a potentially malicious account to a victim's account is not a good idea.

- To resolve this issue, you either mark the unverified account as verified, or then delete that particular login method / account. **You can do these actions using our user management dashboard.**
This used to be an error code which is no longer valid and can be ignored.

### ERR_CODE_004
- This can happen during the thirdparty recipe's signinup API (during sign in):
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -254,24 +254,7 @@ The following is a list of support status codes that the end user might see duri


### ERR_CODE_003
- This can happen during the passwordless recipe's create or consume code API (during sign in):
- API path and method: `/signinup/code POST` or `/signinup/code/consume POST`
- Output JSON:
```json
{
"status": "SIGN_IN_UP_NOT_ALLOWED",
"reason": "Cannot sign in / up due to security reasons. Please try a different login method or contact support. (ERR_CODE_003)"
}
```
- The pre build UI on the frontend displays this error in the following way:
<img src="/img/account-linking/err_003.png" alt="Pre built UI screenshot showing error message for ERR_CODE_003." style={{
height: "400px"
}}/>

- Below is as example scenario for when this status is returned (one amongst many):
A malicious user has a passwordless account with email `e1`. The victim has an email password login method with `e2`, which is verified. Both of these are non primary users since you have account linking switched off. Then you switch on automatic account linking. Now the attacker somehow changes their email to `e2` (via a support ticket perhaps), but it's in an unverified state. In this case, when the attacker enters email `e2` in the passwordless login box, this error code will show up. We do this because if we didn't, then the attacker might send a magic link to `e2`, and if the victim clicks on it, then the attacker's account will be linked to the victim's account. Even though the attacker won't be able to login to that account again, linking a potentially malicious account to a victim's account is not a good idea.

- To resolve this issue, you either mark the unverified account as verified, or then delete that particular login method / account. **You can do these actions using our user management dashboard.**
This used to be an error code, which is no longer valid and can be ignored.

### ERR_CODE_004
- This can happen during the thirdparty recipe's signinup API (during sign in):
Expand Down

0 comments on commit 3f801fa

Please sign in to comment.