🚀 Feature: Don’t let users login without verifying email address #606

New Issue

OVERLORD · 2026-02-04T20:38:34+03:00

OVERLORD commented

2026-02-04 20:38:34 +03:00

Originally created by @NeurekaSoftware on GitHub (Jan 11, 2026).

Feature description

This feature request would build on #1223 and #810

Currently, users are able to login and authenticate without verifying their email address.

This results in:

A malicious actor could register using another person’s email address to impersonate them.
A malicious actor could block the legitimate owner from registering.
A malicious actor could login to other apps using oidc.

Once again, this can be done within software applications directly, but I believe it is the responsibility of the OIDC provider to secure user accounts. As it stands, I cannot open signups to the web.

Pitch

Please force email verification at signup, and do not create the account until emails have been verified.
Do not let users change their email without first verifying the new email address.
Any users that currently have an unverified email address, force them to verify it before they can login again.
Do not allow users to authenticate with OIDC clients without first verifying their email address.

Originally created by @NeurekaSoftware on GitHub (Jan 11, 2026). ### Feature description This feature request would build on #1223 and #810 Currently, users are able to login and authenticate without verifying their email address. This results in: - A malicious actor could register using another person’s email address to impersonate them. - A malicious actor could block the legitimate owner from registering. - A malicious actor could login to other apps using oidc. Once again, this can be done within software applications directly, but I believe it is the responsibility of the OIDC provider to secure user accounts. As it stands, I cannot open signups to the web. ### Pitch - Please force email verification at signup, and do not create the account until emails have been verified. - Do not let users change their email without first verifying the new email address. - Any users that currently have an unverified email address, force them to verify it before they can login again. - Do not allow users to authenticate with OIDC clients without first verifying their email address.

OVERLORD added the needs more upvotes label 2026-02-04 20:38:34 +03:00

OVERLORD commented

2026-02-04 20:38:37 +03:00

@jonnywright commented on GitHub (Jan 16, 2026):

Whilst I agree with the principle, I do think this should be an opt-in feature and not something enforced across all deployments (or at least retain the current feature of being able to manually mark an email address as verified). I expect that the types of deployments for this service are very diverse, and there could be instances where pseudo-email addresses are used, and therefore impossible to verify (perhaps in isolated, offline environments).

The way this issue reads to me is that all deployments should enforce actual email address verification, which may not be possible in some deployments.

@jonnywright commented on GitHub (Jan 16, 2026): Whilst I agree with the principle, I do think this should be an opt-in feature and not something enforced across all deployments (or at least retain the current feature of being able to manually mark an email address as verified). I expect that the types of deployments for this service are very diverse, and there could be instances where pseudo-email addresses are used, and therefore impossible to verify (perhaps in isolated, offline environments). The way this issue reads to me is that all deployments should enforce actual email address verification, which may not be possible in some deployments.

OVERLORD commented

2026-02-04 20:38:43 +03:00

@NeurekaSoftware commented on GitHub (Jan 17, 2026):

Whilst I agree with the principle, I do think this should be an opt-in feature and not something enforced across all deployments (or at least retain the current feature of being able to manually mark an email address as verified). I expect that the types of deployments for this service are very diverse, and there could be instances where pseudo-email addresses are used, and therefore impossible to verify (perhaps in isolated, offline environments).

The way this issue reads to me is that all deployments should enforce actual email address verification, which may not be possible in some deployments.

Opt in sounds reasonable to me, I just need a way to deploy a public service securely. :)

@NeurekaSoftware commented on GitHub (Jan 17, 2026): > Whilst I agree with the principle, I do think this should be an opt-in feature and not something enforced across all deployments (or at least retain the current feature of being able to manually mark an email address as verified). I expect that the types of deployments for this service are very diverse, and there could be instances where pseudo-email addresses are used, and therefore impossible to verify (perhaps in isolated, offline environments). > > The way this issue reads to me is that all deployments should enforce actual email address verification, which may not be possible in some deployments. Opt in sounds reasonable to me, I just need a way to deploy a public service securely. :)

OVERLORD referenced this issue

2026-02-04 20:58:38 +03:00

[PR #606] [MERGED] chore(translations): update translations via Crowdin #849

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#606