immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 11 Packages Projects Releases 10 Wiki Activity

[BUG] User registration email format is not enforced in API #133

New Issue
Closed
opened 2026-02-04 17:59:47 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-04 17:59:47 +03:00
Owner
Copy Link

Originally created by @bo0tzz on GitHub (Jul 6, 2022).

Originally assigned to: @jbaez on GitHub.

When registering a user and signing in, you are expected to enter an email address for the user. The various forms enforce that this should be an email address, but the backend API does not. With a (manual) request to the API, it is possible to create an account with an invalid email address. It is then impossible to log in with this user, as the login form enforces the email address format.
I see two possible solutions:

a. Remove all email address validation, and allow using any username (my preference)
b. Enforce the email address validation at the API layer

Either way, I would remove the validation from the login form specifically, to prevent any chance of a lockout.

Originally created by @bo0tzz on GitHub (Jul 6, 2022). Originally assigned to: @jbaez on GitHub. When registering a user and signing in, you are expected to enter an email address for the user. The various forms enforce that this should be an email address, but the backend API does not. With a (manual) request to the API, it is possible to create an account with an invalid email address. It is then impossible to log in with this user, as the login form enforces the email address format. I see two possible solutions: a. Remove all email address validation, and allow using any username (my preference) b. Enforce the email address validation at the API layer Either way, I would remove the validation from the login form specifically, to prevent any chance of a lockout.
OVERLORD commented 2026-02-04 17:59:53 +03:00
Author
Owner
Copy Link

@jbaez commented on GitHub (Jul 14, 2022):

We've discussed this internally, and for the time being we are going to enforce email address for registering users 🙂.
There is a considerable amount of work for switching to username.
We will be adding email validation in the API.

@jbaez commented on GitHub (Jul 14, 2022): We've discussed this internally, and for the time being we are going to enforce email address for registering users 🙂. There is a considerable amount of work for switching to username. We will be adding email validation in the API.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#133
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?