mirror of
https://github.com/pocket-id/pocket-id.git
synced 2026-02-05 00:39:38 +03:00
🚀 Feature: Include service in sign-in email #290
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @RealOrangeOne on GitHub (May 20, 2025).
Feature description
The sign-in email should include the service which was logged in to (either pocket-id itself explicitly, or the name of the OIDC client).
Pitch
The current email doesn't include any details about what authentication was done:
Given the action point for an invalid login is to review settings, it would be good to include which service was logged in to so the services there can be secured too.
@stonith404 commented on GitHub (May 22, 2025):
Pocket ID sends this email when you sign in using a passkey. The email is dispatched before you authorize the service because the sign-in process occurs first, followed by client authorization. Consequently, including the service name in the email is not easily possible.
While technically possible, adding the service name doesn't really make sense. It would only reflect the first client the attacker accessed. Once they have signed into Pocket ID, subsequent sign-ins to other clients do not trigger additional emails.
You can monitor the services the attacker may have accessed by checking the audit log page though.