Open
Description
When using
ACCOUNT_EMAIL_VERIFICATION_BY_CODE_ENABLED
= True
the api endpoint /dj-rest-auth/registration/verify-email/ doesent allow you to confirm email addresses by code unless you have the sessionid of the person that did the signup. This works fine if the user signs up and confirms in the same browser but if one signs up in lets say instagram then goes to their email to confirm the api endpoint blocks them. Im assuming it has to do with all-auth using sessionid but I have not been able to find out how to prevent it. I tried setting HMAC to false but it doesnt work either.
ACCOUNT_EMAIL_CONFIRMATION_HMAC = False
Even trying to write my own confirm does not work. I cant confirm the keys
from allauth.account.models import EmailConfirmationHMAC
from rest_framework.views import APIView
from rest_framework.permissions import AllowAny
from rest_framework.response import Response
from rest_framework import status
class CustomEmailConfirmationView(APIView):
permission_classes = [AllowAny]
def post(self, request):
key = request.data.get('key')
confirmation = EmailConfirmationHMAC.from_key(key)
if not confirmation:
return Response({'detail': 'Invalid confirmation key'}, status=status.HTTP_400_BAD_REQUEST)
try:
confirmation.confirm(request)
return Response({'detail': 'Email confirmed successfully'}, status=status.HTTP_200_OK)
except Exception as e:
return Response({'detail': 'Confirmation failed'}, status=status.HTTP_400_BAD_REQUEST)
Metadata
Metadata
Assignees
Labels
No labels