rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden email verification resend against abuse

Browse Source 
Add a per-address confirmation-email cooldown and disable the
resend/forgot-password submit buttons while the mutation is in
flight so callers cannot flood the mail queue or double-submit.

Signed-off-by: Émile Ré <emile@probo.com>
This commit is contained in:
Émile Ré
2026-07-28 10:35:12 +02:00
parent 5d0882778f
commit 82a62005f8
5 changed files with 66 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/emails/emails.go
View File

@@ -100,7 +100,7 @@ func NewPresenter(baseURL string, fullName string) *Presenter {
}
const (
subjectConfirmEmail = "Confirm your email address"
SubjectConfirmEmail = "Confirm your email address"
subjectPasswordReset = "Reset your password"
subjectInvitation = "Invitation to join %s on Probo"
subjectDocumentApproval = "Action Required – Please review and approve %s compliance documents"
@@ -185,7 +185,7 @@ func (p *Presenter) RenderConfirmEmail(ctx context.Context, confirmationURLPath
textBody, htmlBody, err = renderEmail(confirmEmailTextTemplate, confirmEmailHTMLTemplate, data)
return subjectConfirmEmail, textBody, htmlBody, err
return SubjectConfirmEmail, textBody, htmlBody, err
}
func (p *Presenter) RenderPasswordReset(ctx context.Context, resetPasswordURLPath string, resetPasswordToken string) (subject string, textBody string, htmlBody *string, err error) {