Change of email process security updates

[amplifi]

Steps to reproduce the error

Go to Edit Profile and change the email address on a user account

Actual behavior

The user is not prompted to verify their password to confirm identity before submitting change of email address.

A confirmation email is sent to the new email address, which includes the account username.

The new email address is applied to the account upon form submission (before it is verified via the link in the confirmation email). This means anyone who accesses a user account can change the email address and the user would not be alerted, or the user could change to an incorrect/invalid email address and have no way to recover their account.

Expected behavior

• The confirmation email sent to the new email address should not include the username for security purposes.

• The user's email address in the database should not be updated until after the user clicks the verification link in the confirmation email.

• A separate notification email should also be sent to the old address. In the event of unauthorized changes, this will alert the user to the change.

• The notification email to the old email address should advise the user to let us know immediately if this change was not authorized, and provide them with a contact method.

[dvlshah]

I have solved "The confirmation email sent to the new email address should not include the username for security purposes." part of problem.
I am not able to understand how to solve the second issue that user's email address should not be updated until verification.Can someone please me guide how to approach this.?

[oliverroick]

Changing the email address and sending the verification email happens here for the website and here for the API.

[rinklejain]

Hi @amplifi @oliverroick
I was going through this issue and I wanted to ask if it would be nice to create a separate view for changing email where the user would be asked to enter the current password and only after the password entered matches with the user's password, a confirmation mail will be sent to the new email.
If we follow the method as mentioned in the issue, we probably would have to change our DB structure and save both the new email and current email, though I am not sure about it. It would be nice if you could share more information about it.

[oliverroick]

Hi @Rjain111 thanks for your interest in fixing this issue. Fully addressing this issue requires some design work and planning upfront, which haven't completed yet. That's why we haven't tagged this issue for as first-contribution friendly.