Category not accepting "anonymous email" from known users

Contribute Bug
18

I think the behavior here is deliberate a fix here is going to have to be pretty comprehensive.

The trouble with allowing people to associate a topic with an existing account is that anyone can spoof anyone’s email.

It think the way of resolving this long term is:

  1. sam@somewhere.com has an account on Discourse.
  2. sam@somewhere.com emails a category with anonymous email in
  3. Discourse sends an email to sam@somewhere.com: "looks like you posted: CONTENTS OF POST, to URL of Discourse. Was it really you?
  4. Click yes
  5. Topic is created

Without this protection this feature would be wide open to impersonation which is very risky.

5 Likes