Hi everyone,
I run Flarum 1.8.19 as the community layer of my own website. My site is the identity provider: users log in on my site and I bridge them into Flarum with maicol07/flarum-ext-sso. Because of that, I need my own code to be the only thing that decides whether a session may be created.
The problem: when someone registers through Flarum's own sign-up form, they are logged in immediately, before the email is confirmed. Looking at Flarum\Forum\Controller\RegisterController, this is unconditional:
$token = RememberAccessToken::generate($userId);
$this->authenticator->logIn($session, $token);
$response = $this->rememberer->remember($response, $token);
There seems to be no setting or permission to gate it, and the Registered / Saving events fire before this point, so a listener can't prevent it.
What I want to achieve: no session at all until the email address is confirmed, and rejecting (or flagging) sign-ups made with disposable/temporary email addresses, so I can either delete those accounts or notify the admin.
I'm aware that an unconfirmed user doesn't get Group::MEMBER_ID and therefore has guest-level permissions, so the practical risk is limited — but I'd still prefer no authenticated session to exist at all.
My questions:
- Is there an existing setting or extension I've missed that makes the post-registration login conditional on email confirmation?
- Is overriding the route the recommended approach here? i.e.
(new Extend\Routes('forum'))->remove('register'),
(new Extend\Routes('forum'))->post('/register', 'register', MyRegisterController::class),
with a controller identical to core's minus the logIn() / remember() calls. Is that considered upgrade-safe, and does anything else in core or in common extensions assume the user is authenticated right after POST /register? (The sign-up modal only does window.location.reload(), so the UI seems fine with it, but I'd like to be sure.)
- Is there a cleaner extension point I should use instead — for example a middleware, or an extender that could make
SessionAuthenticator::logIn() refuse unconfirmed users globally?
- For the disposable-email part, is
fof/disposable-emails still the recommended option, or would a custom Extend\Validator rule on UserValidator be the better place to add my own domain checks?
- Would a core PR adding a setting like "require email confirmation before sign-in" have any chance of being accepted, or is this considered out of scope for core?
Thanks a lot for any pointers.
