Magic Link Login without automatic user creation

[kelkes]

Allow people to sign up via a form using the sign-up functions from nHost BUT don't auto sign up people when they use magic link login.

Context: I have an app where people can register with all their data and use magic-link as one of the sign-up methods. Unfortunately, people use the magic-link login without registering upfront, leading to "empty" users (no profile data nothing). And an empty app (because they have no data created).

I don't want to disable sign up and create users in my backend. An Option for magic-link login that fails when the user is given instead of creating a new user would be best.

Thanks,
David

Reference: #201 (comment)

[dbarrosop]

Hi,

that makes sense. However, this feature should probably be more generic, i.e.:

• Extend to all endpoints that "autosignup" (passwordless, oauth, etc)
• Add an option to enable/disable "autosignup"

Regards

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[xmlking]

autosignup customization is nice to have for all passwordless logins.

otherwise, bad actors can miss use this feature to send Magic Link Login emails to real users.

[dbarrosop]

otherwise, bad actors can miss use this feature to send Magic Link Login emails to real users

not sure I understand this concern. What would a bad actor gain with this? Also, how would disabling autosignup prevent this? They could still call both /signup/passwordless/email /signin/passwordless/email and hope one of them will send the email.

[xmlking]

1. I want to force users go through registration with email and password first , then they optionally use magic link during signin
2. With autosignup, bad actors can create tons of accounts in my database with junk emails. I want to prevent them form DDoS my database more then worry about spam emails.

my usecase : /signup/passwordless/email should be blocked but /signin/passwordless/email should be allowed and behaved like reset password.