oAuth (GitHub) email verification #2305

New Issue

OVERLORD · 2026-02-05T03:36:40+03:00

OVERLORD commented

2026-02-05 03:36:40 +03:00

Originally created by @ArieLevs on GitHub (Jun 23, 2021).

Describe the bug
I'm not sure if its a bug or expected behavior,
but when setting up oauth vis GitHub and allowing registration the application tries to send a verification email.
I'm not sure why?

Steps To Reproduce
Steps to reproduce the behavior:

Setup authentication via GitHub
Enable registration so new users can register (for application settings)
Click the Don't have an account? on login screen
Choose Sign up with GitHub

Expected behavior
If using oAuth email verification should not be enforced.

Screenshots
If applicable, add screenshots to help explain your problem.

Your Configuration (please complete the following information):

Exact BookStack Version: v0.31.6
Hosting Method (Nginx/Apache/Docker): Docker

Originally created by @ArieLevs on GitHub (Jun 23, 2021). **Describe the bug** I'm not sure if its a bug or expected behavior, but when setting up oauth vis GitHub and allowing registration the application tries to send a verification email. I'm not sure why? **Steps To Reproduce** Steps to reproduce the behavior: 1. Setup [authentication via GitHub](https://www.bookstackapp.com/docs/admin/third-party-auth/#github) 2. Enable registration so new users can register (for application settings) 3. Click the `Don't have an account?` on login screen 4. Choose `Sign up with GitHub` **Expected behavior** If using oAuth email verification should not be enforced. **Screenshots** If applicable, add screenshots to help explain your problem. **Your Configuration (please complete the following information):** - Exact BookStack Version: v0.31.6 - Hosting Method (Nginx/Apache/Docker): Docker

OVERLORD closed this issue

2026-02-05 03:36:43 +03:00

OVERLORD commented

2026-02-05 03:36:47 +03:00

@ssddanbrown commented on GitHub (Jun 23, 2021):

Hi @ArieLevs,
Within the settings of your BookStack instance, Are you using the "Domain Restriction" or "Email Confirmation" options at all?

@ssddanbrown commented on GitHub (Jun 23, 2021): Hi @ArieLevs, Within the settings of your BookStack instance, Are you using the "Domain Restriction" or "Email Confirmation" options at all?

OVERLORD commented

2026-02-05 03:36:52 +03:00

@ArieLevs commented on GitHub (Jun 23, 2021):

Hi @ssddanbrown, yes we use domain restriction (but not email confirmation),
I assume this should of been a feature request instead of a bug issue,
to add "allowed github organizations" or "restrict by GitHub user email".

The behavior is not 100% clear,
if for example I add test.com as restriction, and then try to register with GitHub user that has an email of gmail.com then I get message "The email domain does not have access to this application",
this means that the restriction works as expected,
but because it's a oauth user i'd assume verification would not be needed.

Thanks for the quick response, I'll close this one.

@ArieLevs commented on GitHub (Jun 23, 2021): Hi @ssddanbrown, yes we use domain restriction (but not email confirmation), I assume this should of been a feature request instead of a bug issue, to add "allowed github organizations" or "restrict by GitHub user email". The behavior is not 100% clear, if for example I add `test.com` as restriction, and then try to register with GitHub user that has an email of `gmail.com` then I get message "The email domain does not have access to this application", this means that the restriction works as expected, but because it's a oauth user i'd assume verification would not be needed. Thanks for the quick response, I'll close this one.

OVERLORD commented

2026-02-05 03:36:58 +03:00

@ssddanbrown commented on GitHub (Jun 23, 2021):

Thanks for confirming @ArieLevs,

It's worth reading the "Automatic Email Confirmation" section of this page: https://www.bookstackapp.com/docs/admin/third-party-auth/

Setting GITHUB_AUTO_CONFIRM_EMAIL=true should mean that GitHub provided email addresses are treated as verified.

@ssddanbrown commented on GitHub (Jun 23, 2021): Thanks for confirming @ArieLevs, It's worth reading the "Automatic Email Confirmation" section of this page: https://www.bookstackapp.com/docs/admin/third-party-auth/ Setting `GITHUB_AUTO_CONFIRM_EMAIL=true` should mean that GitHub provided email addresses are treated as verified.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2305