- 🇩🇪Germany Anybody Porta Westfalica
This is still an important improvement and security precondition for ✨ Allow users to login using either their username OR their e-mail address Active . The current situation also allows for easier social engineering, if an email address doesn't match the username or even the email address or username of someone else.
- First commit to issue fork.
- Merge request !11087Check usernames that are email addresses more rigidly, only allow if matches email → (Open) created by quietone
- 🇳🇿New Zealand quietone
Converted to an MR
Still needs an IS update as there is no indication there are what has been agreed to. - 🇺🇸United States smustgrave
Test coverage definitely seems to cover the basis
Left some comments in the MR.Personally #2 seems like the least disruptive. Know on a few sites we use SSO which makes the username the email because there is no registration form. Feel option #1 would break that immediately
#3 also seems like a good approach.