Security flaw in facebook Wiki Example

[bguest]

I just want to point out that finding records via an email address and no-password for the current session seems like huge security flaw. You are relying on Facebook or other omniauth provider to verify email addresses, and although they probably do a good job, It's out of your hands. All a user would have to do to gain access to someone else's account on your website would be to change their email address on Facebook to the desired email that they wanted access too. Much better to get retrive user accounts via there uid and provider...

[josevalim]

Can you please update the wiki? The wiki are community maintained and sometimes such things pop-up. Thanks a lot!

[bguest]

I corrected it to what works for me.. Maybe not perfect...

On Jun 9, 2012, at 7:29 AM, José Valim wrote:

Can you please update the wiki? The wiki are community maintained and sometimes such things pop-up. Thanks a lot!

---

Reply to this email directly or view it on GitHub:
#1906 (comment)