refactor: use bcrypt hash

feat: invalidate old password if the user was not confirmed
2025-04-08 12:31:52 +05:30 · 2025-04-07 13:57:07 +05:30
1 changed files with 12 additions and 0 deletions
@@ -10,8 +10,20 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa
  private

  def sign_in_user
+    was_confirmed = @resource.confirmed? if confirmable_enabled?
    @resource.skip_confirmation! if confirmable_enabled?

+    # rubocop:disable Rails/SkipsModelValidations
+    # Set random password if user was not previously confirmed
+    # This is to prevent an malicious user from acting in
+    # case they created an account with this email before
+    if confirmable_enabled? && !was_confirmed
+      # Generate proper bcrypt hash for the password instead of storing raw password
+      encrypted_password = BCrypt::Password.create(SecureRandom.hex(32))
+      @resource.update_column(:encrypted_password, encrypted_password)
+    end
+    # rubocop:enable Rails/SkipsModelValidations
+
    # once the resource is found and verified
    # we can just send them to the login page again with the SSO params
    # that will log them in
Author	SHA1	Message	Date
Shivam Mishra	85770b44b8	refactor: use bcrypt hash	2025-04-08 12:31:52 +05:30
Shivam Mishra	e69f043cdf	feat: invalidate old password if the user was not confirmed	2025-04-07 13:57:07 +05:30