Honor Apple's email_verified claim before linking accounts - #21
Merged
Merged
Conversation
verifyAppleIdToken returned { sub, email } unconditionally, ignoring the
email_verified claim. That email flows into tryLinkOAuthUserByEmail, which
adopts any existing account holding it — so an unverified Apple email could
claim another user's account.
Mirror the Google path: read email_verified, treat it as verified only when
it is boolean true or the string "true", and return the email only when
verified (undefined otherwise). This affects both the redirect callback and
the native Apple endpoint, which is correct.
- worker/routes/oauth.ts: add email_verified to the decoded payload type and
gate the returned email on it in verifyAppleIdToken.
- tests/worker/oauth.test.ts: createAppleIdToken gains an emailVerified
option; regression tests assert an unverified email takes the new-user
path without adopting a pre-seeded account (no session), and a verified
email links to and adopts it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015EkRWLSbdRZqE9uCeuuQce
Co-authored-by: jackowayed <18899+jackowayed@users.noreply.github.com>
jackowayed
force-pushed
the
claude/oy-11-apple-email-verified
branch
from
August 11, 2026 16:04
0c3cb7b to
d2b5987
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
verifyAppleIdToken returned { sub, email } unconditionally, ignoring the email_verified claim. That email flows into tryLinkOAuthUserByEmail, which adopts any existing account holding it — so an unverified Apple email could claim another user's account.
Mirror the Google path: read email_verified, treat it as verified only when it is boolean true or the string "true", and return the email only when verified (undefined otherwise). This affects both the redirect callback and the native Apple endpoint, which is correct.
This finding was OY-11 in the ID scheme my audit session came up with :P
Claude-Session: https://claude.ai/code/session_015EkRWLSbdRZqE9uCeuuQce