Topics tagged with verification

Does fusion auth supports es256k header for secp256k1 curve keys?

dan — Invalid Date

I'm not sure what you mean? Are you talking about the JWT generated for a login event?

fusion auth versus jose4j library for jwt using secp256k

benjamineroommen — Invalid Date

ok main thing is, is it ok to use header ES256 for jwt created using secp256k1 keys?

https://datatracker.ietf.org/doc/html/rfc8812 says, secp256k1 curve should only be used with ES256k header, but in authfusion even if we give k1 pair keys and then use sign and encode a JWT using EC, it will come as ES256 only, is that okay?

Another doubt is, those jwt (k1 curve keys + ES256) created in authfusion is only able to verify in jose4j with .setRelaxVerificationKeyValidation() //needed if the key is smaller than 256 bits.

Without it we get the error:

JWT processing failed. Additional details: [[17] Unable to process JOSE object (cause: org.jose4j.lang.InvalidKeyException: ES256/SHA256withECDSA expects a key using P-256 but was null):

Description inside setRelaxVerificationKeyValidation :

Bypass the strict checks on the verification key. This might be needed, for example, if the JWT issuer is using 1024-bit RSA keys or HMAC secrets that are too small (smaller than the size of the hash output)

Is it the correct way to validate jwt created using ec in authfusion?

Email Send exception while calling the /registration API

apeksha.barhanpur — Invalid Date

Hi,

We are calling the /api/user/registration API to create and register a new user. Our requirement is that we want to send an email verification first to the user, only after the user clicks on the link and verifies the email then we would like the user to be verified in FusioanAuth.

Based on the API documentation it states that when we make a request to this API and if the "skipVerification" is set to default with is "false" it should send an email verification to the newly created user. And then the user should get an email.

Though the call is successful we are getting the following error within the event logs while sending the email.

Async Email Send exception occurred.

Template Id: 0e107c44-a3de-4607-b51c-cd797463ce3a
Template Name: [FusionAuth Default] Email Verification
Tenant Id: 07448f27-ca36-9612-8b9a-bce2e7137351
Addressed to: apekshagb@gmail.com

Cause:
javax.mail.MessagingException : Message: Could not connect to SMTP host: 127.0.0.1, port: 1025

I did try to use an external SMTP server as mailcatcher but that didn't work either. Are we missing any configuration or we need to call a different API?

Regards
Apeksha

Verification of ID Token using RSA public key

dan — Invalid Date

@gokul-mahajan20

Can you add ----BEGIN to the JWKS certs?

Link in Email verification not working first time

skelsec — Invalid Date

We have the exact same issue. If this was solved (hopefully) could you please provide a brief description on the fix?
Thanks!

Email verification security hole?

dan — Invalid Date

If you are using email verification, you can check this user state within your own app. (So, don't allow the attacker to access anything until their email address has been verified.)

In version 1.27.0 you can configure a gated login flow when the user is not verified (this is a 'reactor' feature requiring a paid license). This will enforce email verification before we even redirect to your app. You can then also configure FusionAuth to delete users after N number of days if the user has not verified their email address. This can assist with build up of accounts that are not actually in use.

Unable to invoke @ValidationMethod on the class [class io.fusionauth.app.action.oauth2.CompleteRegistrationAction]

joshua — Invalid Date

@alessandrojcm,

Sounds good. I have logged a bug report; we should have this one squashed soon!

Thanks,
Josh

Does FusionAuth support the ability to use codes for verification?

dan — Invalid Date

Yes. As of 1.27, you can use a verification strategy of FormField. This is configured on the tenant: https://fusionauth.io/docs/v1/tech/apis/tenants/

You then provide the one time code in the oneTimeCode request body parameter. More about this in the email verification docs: https://fusionauth.io/docs/v1/tech/apis/users/#verify-a-users-email

Note that this feature only works with email gating at the current time, which is a reactor feature requiring a paid license.

Email verification email for 'welcome message'

dan — Invalid Date

You are correct. The verified flag exists on the corresponding user and the registration. You could optionally use the "verify registration" templatefor this purpose.

If you then ignored the verified: false flag on the registration in your code, it should not impact you.

Another option would be to listen for the user.registration.create event and then fire off an email on your end, or call the Email Send API to send a pre-made FusionAuth email template as a welcome event: https://fusionauth.io/docs/v1/tech/apis/emails/#send-an-email

Email verification without sending emails?

dan — Invalid Date

You could use the skipVerification parameter (set it to true) on the user or registration create statement, and then the https://fusionauth.io/docs/v1/tech/apis/users#resend-verification-email call with sendVerifyEmail set to false.

This would give you a verificationId you could use with this API call: https://fusionauth.io/docs/v1/tech/apis/users#verify-a-users-email

The default templates are being marked as spam?

dan — Invalid Date

It looks like the issue was our mail server. We are using Mailgun SMTP service for our mail sending and this offers a tracking feature.

This tracking feature adds a invisible image to the html code in order to get request for stats. If I deactivate this feature, the HTML_IMAGE_ONLY_12 error is gone and the mail are no longer marked as SPAM. We don't have any issues with our other applications because sent emails are bigger in text content.

Token difference when account hasn't been verified

dan — Invalid Date

The JWT (id_token or access_token) will contain the email_verified claim with a value of true or false, so if you wish to limit privilege based upon this state, that would be a good way to do it.