Skip to content

Can't Confirm By Code Using api #671

Open
@memetrusidovski

Description

@memetrusidovski

When using

ACCOUNT_EMAIL_VERIFICATION_BY_CODE_ENABLED = True

the api endpoint /dj-rest-auth/registration/verify-email/ doesent allow you to confirm email addresses by code unless you have the sessionid of the person that did the signup. This works fine if the user signs up and confirms in the same browser but if one signs up in lets say instagram then goes to their email to confirm the api endpoint blocks them. Im assuming it has to do with all-auth using sessionid but I have not been able to find out how to prevent it. I tried setting HMAC to false but it doesnt work either.

ACCOUNT_EMAIL_CONFIRMATION_HMAC = False

Even trying to write my own confirm does not work. I cant confirm the keys

from allauth.account.models import EmailConfirmationHMAC
from rest_framework.views import APIView
from rest_framework.permissions import AllowAny
from rest_framework.response import Response
from rest_framework import status

class CustomEmailConfirmationView(APIView):
    permission_classes = [AllowAny]

    def post(self, request):
        key = request.data.get('key')
        confirmation = EmailConfirmationHMAC.from_key(key)
        
        if not confirmation:
            return Response({'detail': 'Invalid confirmation key'}, status=status.HTTP_400_BAD_REQUEST)
        
        try:
            confirmation.confirm(request)
            return Response({'detail': 'Email confirmed successfully'}, status=status.HTTP_200_OK)
        except Exception as e:
            return Response({'detail': 'Confirmation failed'}, status=status.HTTP_400_BAD_REQUEST)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions