starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Security/OIDC: Allow enabling of check for email_verified field in JWT payloads for existing accounts #3092

New Issue
Open
opened 2026-04-25 00:13:37 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:13:37 +02:00
Owner
Copy Link
Copy Source

Originally created by @ZLoth on GitHub (Nov 14, 2025).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

In Authentication → OpenID Connect Authentication, there should be an option for an administrator to enforce verified email for pre-existing ABS accounts.

Why would this be helpful?

As discussed in https://github.com/advplyr/audiobookshelf/issues/4830, the current policy of ABS is that the check for the email_verified is only conducted when a new account creation request comes from the OIDC provider, but not when the account already exists. The assumption is that once a email is verified, it remains in a verified state.

I feel that this is a bad security assumption, as this should always be checked when a user is logging in through the OIDC provider. As turning on immediate enforcement of this policy may cause issues, I request that a toggle be put in with a default set to Off and that the administrator be allowed to turn it on.

Future Implementation (Screenshot)

Image

Audiobookshelf Server Version

2.30

Current Implementation (Screenshot)

None.

Originally created by @ZLoth on GitHub (Nov 14, 2025). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement In **Authentication** → **OpenID Connect Authentication**, there should be an option for an administrator to enforce verified email for pre-existing ABS accounts. ### Why would this be helpful? As discussed in https://github.com/advplyr/audiobookshelf/issues/4830, the current policy of ABS is that the check for the `email_verified` is only conducted when a new account creation request comes from the OIDC provider, but not when the account already exists. The assumption is that once a email is verified, it remains in a verified state. I feel that this is a bad security assumption, as this should always be checked when a user is logging in through the OIDC provider. As turning on immediate enforcement of this policy may cause issues, I request that a toggle be put in with a default set to Off and that the administrator be allowed to turn it on. ### Future Implementation (Screenshot) <img width="855" height="84" alt="Image" src="https://github.com/user-attachments/assets/a0d51cd7-d638-4948-83ef-9a8294c2a523" /> ### Audiobookshelf Server Version 2.30 ### Current Implementation (Screenshot) None.
adam added the enhancement label 2026-04-25 00:13:37 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3092
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?