preventLoginWithUnverifiedEmail not Working

[calhouncole]

Issue Description

I am running parse-server v. 2.2.22. In my ParseServer configuration, I have preventLoginWithUnverifiedEmail = true. On signup, before a user verifies their email, it still logs them in.

My configuration:

var parse_api = new ParseServer({
  databaseURI: process.env.MONGOLAB_URI || 
  config.databaseURI,
  // cloud: './cloud/main.js',
  appId: config.parseAppId,
  fileKey: config.parseFileKey,
  masterKey: config.parseMasterKey,
  serverURL: process.env.PARSE_SERVER_URL || config.parseServerURL,
  publicServerURL: config.parsePublicServerURL,
  verifyUserEmails: config.parseVerifyUserEmails,
  appName: config.parseAppName,
  facebookAppIds: config.facebookAppIds,
  preventLoginWithUnverifiedEmail: config.parsePreventLoginWithUnverifiedEmail,
   // The email adapter
  emailAdapter: {
    module: config.parseEmailAdapterModule,
    options: {
      // The address that your emails come from
      fromAddress: config.parseFromEmailAddress,
      // Your domain from mailgun.com
      domain: config.parseEmailDomain,
      // Your API key from mailgun.com
      apiKey: config.parseEmailAPIKey,
    }
  }
});

Steps to reproduce

Please include a detailed list of steps that reproduce the issue. Include curl commands when applicable.

1. Sign up a user
2. Do not verify the email address
3. Try and login

Expected Results

The User will be blocked from login during signup.

Actual Outcome

The User is logged no problem.

Environment Setup

• Server
  • parse-server version : 2.22.22
  • Localhost or remote server? Heroku
• Database
  • MongoDB version: 3.2.9
  • Localhost or remote server?: mLab

Logs/Trace

2016-10-13T03:55:00.897370+00:00 app[web.1]: GET /parse/login 200 103.378 ms - 341

[flovilmart]

Hi, we have a unit test especially covering that case here: https://github.com/ParsePlatform/parse-server/blob/ad707457be13f177e4a0dc481c990ddbd2df8d80/spec/ValidationAndPasswordsReset.spec.js#L241

Can you please confirm that your configuration is correct and not any differences between the test and you actual setup?

[cherukumilli]

@calhouncole
I just tested it with version 2.2.21 and it works fine i.e., for your use case parse-server throws an error with error message User email is not verified. and error code: 205.

is there any way you can print the values of the following to the console to check and make sure they are set correctly to true?

config.parseVerifyUserEmails,
config.parsePreventLoginWithUnverifiedEmail

I will upgrade my parse-server to 2.2.23 and I will try it again later during the day.

[joshuadiezmo]

i have same issue.

i just want to block user that is not verified.

and also i did not want to send them a verification code because i want that admin will verify them

[cherukumilli]

@ReverseFlash28

I wonder if the values being passed to verifyUserEmails and preventLoginWithUnverifiedEmail are not in a boolean format. i.e., String "true" vs Boolean true.

Can you please hardcode the values of the following to true as a test to see if it works? If this works then I will submit a new PR to convert the value passed to these two options to a boolean.

  verifyUserEmails: true,
  preventLoginWithUnverifiedEmail: true,

[fduch2k]

I'm faced with the same problem. After some research I found that preventLoginWithUnverifiedEmail checked only in UsersRouter.handleLogIn, which is used only as handler for /login api. So inside signUp flow preventLoginWithUnverifiedEmail does not checked. I think that better place to validate this option somewhere inside RestWrite.runDatabaseOperation

[flovilmart]

signUp flow preventLoginWithUnverifiedEmail does not checked.

That's the whole point of, it anyone can signup, but you need your email to be verified to be able to login. In that case, probably the signUp should not issue a session token.

[fduch2k]

signUp should not issue token, it also should return the same error as logIn (but User should be created)

[flovilmart]

If this yields an error, user should not be created

[fduch2k]

So, if server not able to create session (for any reason - db connection error or s.th. else) user which already created must be deleted? Or server should not raise error because user is exists in db?

I don't understand why login should raise error, but signup not.

[flovilmart]

what we should do is simply not return the session token upon signup if the server is configured to require a verified email.

[flovilmart]

@fduch2k do you want to take on the implementation as discussed?