mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-09 23:02:59 +03:00
🐛 Bug Report: Email comparison is case sensitive #113
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @yann117 on GitHub.
Originally assigned to: @kmendell on GitHub.
Reproduction steps
When using the "Email login" (requesting a one-time code per email), the end-user has to type in their email, which is then searched in the database for a match, and if found, it will send the code to the corresponding email.
Now the code doesn't make a case-insensitive search, and therefore any case difference will fail.
This makes the login process quite fragile, inconsistent, in particular for end-users who won't be able to login on this new system (they are already lost with just the access keys concept).
This is particularly true since on Android mobile, the system will automatically change the first typed-in character of the user-input/email in Uppercase, making the process fail in 100% of the cases.
Expected behavior
I don't know any system that makes use of case-sensitive emails, it should not make any difference.
PocketId should make case-insensitive emails comparison, to ensure a robust, resilient login mechanism.
Actual Behavior
The code makes a simple search (assuming case-sensitive):
https://github.com/pocket-id/pocket-id/blob/main/backend/internal/service/user_service.go#L358
(I also quickly searched into the frontend code, and haven't found a tolowercase or any similar handling).
Version and Environment
latest
Log Output
No response
@yann117 commented on GitHub:
ChatGPT tell me that this is the wrong RFC, RFC 1035 applies to DNS/domain. For Emails it would be RFC 5321 (section 2.4).
But anyway, this is only for the SMTP server and probably does not make sense/meant for matching userId (only case would be when sending an email to the corresponding user, I assume we should take the exact email set for the user account).
Going further, I read that 99% of email providers do not apply this RFC/case sensitivity to avoid errors. In practice, this really looks like overkill and PocketId would probably be the only one doing that as an exception ... with the observed common failure due to the Android UI fiddling with user input.
@ItalyPaleAle commented on GitHub:
#776 should fix this by setting
type="email"on the input, which disables auto-capitalization@ItalyPaleAle commented on GitHub:
Perhaps the fix would be on the UI then, to disable auto-capitalization on the user input field
@kmendell commented on GitHub:
I'll work on this later tonight, Thank you for reporting!
@ItalyPaleAle commented on GitHub:
Just a note that the "local part" of email addresses (before the
@) should be treated as case-sensitive per the RFC. More info here: https://stackoverflow.com/a/9808332/192024