mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-26 01:02:16 +00:00
Liam NevilleandGitHub
67a02a6aeb
# Which Problems Are Solved Enterprise email link scanners (used by organizations for security) pre-fetch URLs in emails to check for malicious content. In Login V2, email verification codes are automatically redeemed when the verification page loads. This causes link scanners to inadvertently consume one-time verification codes before users can click them, resulting in "code already used" errors. # How the Problems Are Solved - Changed the default behaviour so that verification codes are **not** auto-submitted on page load — users must click a Submit button to redeem the code - Added a new environment variable `NEXT_PUBLIC_AUTO_SUBMIT_CODE` that can be set to `true` to re-enable auto-submission for instances where link scanners are not a concern - The env var is named generically so it can be extended to other auto-submit flows (e.g. Email OTP) in the future # Additional Changes None # Additional Context Closes #11406
57 lines
2.0 KiB
TypeScript
57 lines
2.0 KiB
TypeScript
declare namespace NodeJS {
|
|
interface ProcessEnv {
|
|
// Allow any environment variable that matches the pattern
|
|
[key: `${string}_AUDIENCE`]: string; // The system api url
|
|
[key: `${string}_SYSTEM_USER_ID`]: string; // The service user id
|
|
[key: `${string}_SYSTEM_USER_PRIVATE_KEY`]: string; // The service user private key
|
|
|
|
AUDIENCE: string; // The fallback system api url
|
|
SYSTEM_USER_ID: string; // The fallback service user id
|
|
SYSTEM_USER_PRIVATE_KEY: string; // The fallback service user private key
|
|
|
|
/**
|
|
* The Zitadel API url
|
|
*/
|
|
ZITADEL_API_URL: string;
|
|
|
|
/**
|
|
* The service user token
|
|
* If ZITADEL_SERVICE_USER_TOKEN is set, its value is used.
|
|
* If ZITADEL_SERVICE_USER_TOKEN is not set but ZITADEL_SERVICE_USER_TOKEN_FILE is set, the application blocks until the file is created.
|
|
* As soon as the file exists, its content is read and ZITADEL_SERVICE_USER_TOKEN is set.
|
|
*/
|
|
ZITADEL_SERVICE_USER_TOKEN: string;
|
|
|
|
/**
|
|
* Optional: wheter a user must have verified email
|
|
*/
|
|
EMAIL_VERIFICATION: string;
|
|
|
|
/**
|
|
* Optional: custom request headers to be added to every request
|
|
* Split by comma, key value pairs separated by colon
|
|
* For example: to call the Zitadel API at an internal address, you can set:
|
|
* `CUSTOM_REQUEST_HEADERS=Host:http://zitadel-internal:8080`
|
|
*/
|
|
CUSTOM_REQUEST_HEADERS?: string;
|
|
|
|
/**
|
|
* The base path the app is served from, e.g. /ui/v2/login
|
|
*/
|
|
NEXT_PUBLIC_BASE_PATH: string;
|
|
|
|
/**
|
|
* Optional: The application name shown in the login and invite emails
|
|
*/
|
|
NEXT_PUBLIC_APPLICATION_NAME?: string;
|
|
|
|
/**
|
|
* Optional: Enable automatic code submission on page load.
|
|
* Set to "true" to auto-submit verification codes (e.g. email verification, Email OTP).
|
|
* Default behavior (undefined) requires users to click a Submit button,
|
|
* which is safer for environments with enterprise email link scanners.
|
|
*/
|
|
NEXT_PUBLIC_AUTO_SUBMIT_CODE?: string;
|
|
}
|
|
}
|