Added password confirmation on account creation & email verification via confirmation link. #11

bjwyse · 2013-02-11T22:20:53Z

No description provided.

Et3rn1ty · 2013-02-20T02:10:25Z

This still needs a link to resend the verification e-mail. Trying to work on that now.

ddoolin · 2013-03-01T16:32:39Z

Querystring hash?

I probably haven't thoroughly thought about this, but is it OK to just be sending the hashed password in a query string for the password reset?

You didn't change it but I wasn't sure where to ask this at.

Et3rn1ty · 2013-03-01T16:35:27Z

Not sure why you're asking on this issue. The verification hashes the username in order to verify. For password reset, why would sending the current password hash be a bad thing? as soon as it's reset the "current" hash may no longer be valid.
EDIT: unless the user changes their password to the exact same password... but then why would they have requested a reset in the first place.
EDIT 2: I dont know that much about encryption so i could be wrong that the same password would have the same hash given a second encryption.

brettz9 · 2020-02-05T03:24:16Z

@bjwyse : I'd like to integrate your changes into my fork. Are you releasing your contributions under the same license as node-login, i.e., MIT?

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - npm: Update mongodb, jamilih, jsdom, and devDeps

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Update mongodb, jamilih, jsdom, and devDeps

- Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - i18n: Client-side i18n - Docs: Avoid mention of MongoDB in description as Adapter could work with other dbs - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Avoid Mongodb warnings by adding bind_ip flag (and add port flag for clarity) - npm: Update mongodb, jamilih, jsdom, and devDeps

- Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - Accessibility: Use h1+ headings - i18n: Client-side i18n - Docs: Avoid mention of MongoDB in description as Adapter could work with other dbs - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Avoid Mongodb warnings by adding bind_ip flag (and add port flag for clarity) - npm: Update expresss-rate-limit, mongodb, jamilih, jsdom, and devDeps

- Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - Accessibility: Use h1+ headings; labels - i18n: Client-side i18n - Docs: Avoid mention of MongoDB in description as Adapter could work with other dbs - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Avoid Mongodb warnings by adding bind_ip flag (and add port flag for clarity) - npm: Update expresss-rate-limit, mongodb, jamilih, jsdom, and devDeps

- Breaking change: Rename `print` page to `users` - Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - Accessibility: Use h1+ headings; labels; roles - i18n: Client-side i18n - Docs: Avoid mention of MongoDB in description as Adapter could work with other dbs - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Avoid Mongodb warnings by adding bind_ip flag (and add port flag for clarity) - npm: Update expresss-rate-limit, mongodb, jamilih, jsdom, and devDeps

- Breaking change: Rename `print` page to `users` - Security: Minimize XSS vectors by using safer jQuery methods - Enhancement: Database abstraction layer - Enhancement: Autocomplete hints - Enhancement: `localScripts` option for using non-CDN copies - Enhancement: Use native form validation - Enhancement: Make `fromText` and `fromURL` of password reset emails configurable - Enhancement: Upon signup, ask for password confirmation - Enhancement: Require email link verification code (inspired by <braitsch#11>) - Enhancement: CLI for adding accounts - Enhancement: Add `NS_EMAIL_TIMEOUT` option - Fix: Requiring of `account.js` - Fix: Pass on CLI args properly - Fix: Add proper plain text for plain text email - Accessibility: Use h1+ headings; labels; roles (passing all except for `color-contrast` whose check we are temporarily disabling until may have time to fix) - i18n: Client-side i18n - Docs: Avoid mention of MongoDB in description as Adapter could work with other dbs - Docs: Add Change log for unreleased - Docs: Indicate planned to-dos - Docs: Some further CLI documentation - Docs: Indicate license types, test results, and coverage as badges - Refactoring: Further separation of view logic out of controllers - Refactoring: Switch to Jamilih templates - Refactoring: Add scripts to head with `defer` - Refactoring: Use variables in place of selectors where possible - Linting (ESLint): As per latest ash-nazg - Testing: Add lcov report (for Atom IDE) - npm: Make scripts cross-platform - npm: Avoid Mongodb warnings by adding bind_ip flag (and add port flag for clarity) - npm: Update expresss-rate-limit, mongodb, jamilih, jsdom, and devDeps

brettz9 · 2020-05-25T10:37:47Z

I went ahead and released 1.0.0 of nogin incorporating these changes which includes these changes (the differences were I think substantial enough from this PR that inspired them). (My changes are breaking, however.)

Note that an update now causes a new activation to be required (user changing email). Email won't be changed until activated.

bjwyse added 2 commits February 11, 2013 22:19

Added password confirmation textfield on account creation.

b924ee8

Add email verification via confirmation link.

39cc622

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added password confirmation on account creation & email verification via confirmation link. #11

Added password confirmation on account creation & email verification via confirmation link. #11

bjwyse commented Feb 11, 2013

Et3rn1ty commented Feb 20, 2013

ddoolin commented Mar 1, 2013

Et3rn1ty commented Mar 1, 2013

brettz9 commented Feb 5, 2020

brettz9 commented May 25, 2020 •

edited

Loading

Added password confirmation on account creation & email verification via confirmation link. #11

Are you sure you want to change the base?

Added password confirmation on account creation & email verification via confirmation link. #11

Conversation

bjwyse commented Feb 11, 2013

Et3rn1ty commented Feb 20, 2013

ddoolin commented Mar 1, 2013

Querystring hash?

Et3rn1ty commented Mar 1, 2013

brettz9 commented Feb 5, 2020

brettz9 commented May 25, 2020 • edited Loading

brettz9 commented May 25, 2020 •

edited

Loading