Daniel Campoverde [alx741]
ea5e1cca26
Update emailLoginHandler 'since' version
2017-02-18 18:28:53 -05:00
Daniel Campoverde [alx741]
c5ddf55937
Update emailLoginHandler 'since' version
2017-02-18 15:14:45 -05:00
Daniel Campoverde [alx741]
c78ae95b3a
Fix email auth module
2017-02-18 15:14:45 -05:00
Daniel Campoverde [alx741]
276a9f1321
Add and export defaultEmailLoginHandler
2017-02-06 16:15:38 -05:00
Michael Snoyman
aefd074efa
Cleanup GHC 8 redundant constraints
2017-02-05 13:35:12 +02:00
Michael Snoyman
3dc2d10b30
Compile with -Wall -Werror
2017-02-05 12:09:18 +02:00
Michael Snoyman
64ed0792bc
Check mime-type for JSON bodies #1330
2017-02-02 08:10:19 +02:00
Michael Snoyman
db883f19b8
Fix some whitespace
2017-02-02 07:43:55 +02:00
Sibi Prabakaran
4330461033
Change the type signature from Text to Verkey
...
Since the other type signatures of the typeclass has VerKey instead of
Text, it would be better to use VerKey here also to maintain
consistency. Also, IMO this signature is more easy to follow ( I had to
look at source to see how the verification key was generated. )
2016-12-30 18:06:40 +05:30
Sibi Prabakaran
08f994103a
Add documentation for JSON endpoints for Yesod.Auth.Email module
2016-12-08 14:25:08 +05:30
Sibi Prabakaran
8f8c99db88
Do parseJsonBody only when form data is not found
2016-12-07 14:08:37 +05:30
Sibi Prabakaran
47b2877c79
More Haddock fixes
2016-12-06 18:44:38 +05:30
Sibi Prabakaran
75df4e0468
Use @since for proper haddock rendering
2016-12-06 18:21:36 +05:30
Sibi Prabakaran
83575e92a0
Fix typo: /s/interoprate/interoperate
2016-12-06 18:20:18 +05:30
Sibi Prabakaran
85bd15d109
Add json support for postPasswordR
2016-12-06 18:17:19 +05:30
Sibi Prabakaran
b6cd72f49f
Implement Login via JSON endpoint
...
Add additional handling of JSON endpoint in addition to the HTML form
method.
2016-12-06 15:20:51 +05:30
Sibi Prabakaran
19840cdc89
Add json support for postRegisterR
2016-12-05 19:32:23 +05:30
Sibi Prabakaran
696faa3fd0
req is not needed.
2016-11-20 13:43:01 +05:30
Sibi Prabakaran
10850f5cee
Use checkCsrfHeaderOrParam instead of manual check
2016-11-20 13:32:15 +05:30
Sibi Prabakaran
7f17d829b3
Fix CSRF security vulnerability in registerHelper function
...
Return a 403 status code if the csrf tokens are matched. This currently
affects two endpoints: During registration and during password reset
forms.
This curl request demonstrates how this can be exploited to register new
email:
curl -i --header "Accept: application/json" --request POST -F
"email=sibi@psibi.in" http://localhost:3005/auth/page/email/register
With the patch applied, it will respond with this:
{"message":"Permission Denied. A valid CSRF token wasn't present in HTTP
headers or POST parameters. Because the request could have been forged,
it's been rejected altogether. Check the Yesod.Core.Handler docs of the
yesod-core package for details on CSRF protection."}
2016-11-20 03:59:32 +05:30
Bryan Richter
add9d4393a
Comment on unsafePerformIO, close #1245
2016-10-03 09:08:22 -07:00
Bryan Richter
5342f891f3
Add key reuse warning ( #1222 ) ( #1233 )
2016-05-14 15:40:07 -07:00
Murray
a15070709d
allow more than one session message and add statuses
2016-03-16 18:14:40 +00:00
Alex Kardos
d76aa1a16e
Converted runFormPosts to generateFormPost
...
This is a cleaner way to generate forms without ignoring one of the
variables.
2016-03-12 18:29:05 -07:00
Alex Kardos
9fb3f61ac8
Moved settings to functions to clean up the form
2016-03-12 18:29:05 -07:00
Alex Kardos
2f0a7fbcc5
Wrapped email login form with an id
2016-03-12 18:29:05 -07:00
Alex Kardos
0c0cb12a10
Used form helper for forgot password form
...
* Removed unused idents
* Isolated form logic
* Added an id around forgot password for styling purposes
2016-03-12 18:28:49 -07:00
Alex Kardos
e3aa310c84
Used monadic form helper for password handler
...
This needed to happen in order to automatically get CSRF protection
Several changes happened while switching over:
* Relied on built in names for inputs
* Cleaned up naming
* Created password helpers for each field
* Added a translation for current password
2016-03-07 16:44:05 -07:00
Alex Kardos
4b78c4d60a
Moved emailLoginHandler out of authEmail
...
The authEmail function was getting large so I moved the
emailLoginHandler out into its own function.
2016-03-05 16:59:02 -07:00
Alex Kardos
d42d38990d
Added translated label to default register handler
...
This was removed on accident.
2016-03-05 16:58:34 -07:00
Alex Kardos
4963f562fe
Converted yesod login screen to monadic form
...
The form helpers weren't being used which caused the CSRF tokens to not
be present. This also allows for a bit more flexability and
cleans up the code as well.
2016-03-03 20:52:08 -07:00
Alex Kardos
1cae0e38ab
Moved login logic into a function
...
This is more clear and looks like the other authorization plugins.
2016-02-20 21:28:20 -07:00
Alex Kardos
456e93fb10
Added autofocus attribute to email input
2016-02-20 13:47:42 -07:00
Alex Kardos
27e1ec3be3
Used email field for input
2016-02-20 13:39:18 -07:00
Alex Kardos
c376146231
Removed whitespace
2016-02-20 13:38:48 -07:00
Alex Kardos
ed5037fa74
Used localized email label
2016-02-20 13:38:19 -07:00
Alex Kardos
3e37983f1c
Added encoding type and removed unused variable
2016-02-20 13:37:43 -07:00
Alex Kardos
76fc5887f9
Fixed registerHandler CSRF issue
...
The default register handler for email authentication didn't provide a
CSRF token. I provided one by using a monadic form helper.
2016-02-17 20:39:09 -07:00
mrkkrp
1976e90be9
Bump password strength to compensate 2 years
...
Computers are now faster than in 2013.
2015-12-03 00:08:51 +06:00
Arthur Fayzrakhmanov (Артур Файзрахманов)
2074915962
Apply stylish-haskell, organize imports
2015-06-24 20:54:27 +05:00
Arthur Fayzrakhmanov (Артур Файзрахманов)
dfd14ea16d
Remove redundant imports
2015-06-24 20:54:27 +05:00
Arthur Fayzrakhmanov (Артур Файзрахманов)
4b05cd83f6
Use nonce package in Auth.Email
...
Generate verification keys using `nonce` package.
2015-06-24 20:54:11 +05:00
Jude Taylor
886e6bdd2c
add ConstrainedClassMethods
2015-06-08 00:30:16 -07:00
Michael Snoyman
fa0fbb4569
Version bump
2015-04-26 18:37:33 +03:00
Richard Zetterberg
9e1516594e
Fixes faulty type annotations
2015-04-26 15:28:45 +02:00
Richard Zetterberg
770a7a29d2
Adds export of verify route
...
This allows users of the library to easily render VerUrl to use in
verification emails to new users, if the user was created outside
of the regular register functionality.
2015-04-26 14:55:12 +02:00
Greg Weber
510f70d5b3
fix typos
2014-09-24 08:07:15 -07:00
Greg Weber
01339ad528
add some documentation for Yesod.Auth.Email
2014-09-24 07:47:13 -07:00
Greg Weber
629df4a291
add required attribute
2014-09-17 12:31:42 -07:00
Greg Weber
2a30519169
fix some import warnings
2014-09-16 18:13:28 -07:00
