Is it obvious how stuff like this is a good surface for spear phishing if done incorrectly?

Idk if it's obvious. But I could sign up with any email even if the invite wasn't sent to that email, and then get added to the invitee's "team" (or whatever structure in the app). So it's a bit weird for sure.

eh... that one relies on the email getting broken into, so it's basically the same as making an account and changing the email of the account

Yea. But a secure system would allow that only if the new email can be veriried

verified*

via a OTP or link sent to it

so lets say that you are dumb and you allow anyone to register their active directory as an identity backend. I register mine and make an account on it for newEngineersName@supertokens.io and ask to be added to your internal groups

Yea. That would be terrible.

or fun, depending on which side you are on

haha..

Talking about the invite system, when we do make one, I don't think we would allow a user to sign up with a diff email than what was used to generate the invite link. If someone really wants to do that, they could ask the invitee to generate a new link to the desired email address.

Hi there, I'm trying to build an app from the ground up and I'm wondering: in which part of development should supertokens be integrated? Should i start with a supertokens implementation and then build around that?

hey @User you should start with supertokens and build on top of that.

Since I assume you will have to build a bunch of APIs that can be accessed post login. In which case, it's better to have the auth layer of the app already ready.

Ok thanks

Hi, I've just found out about supertokens. Is there a recipe/example usage of the library with graphql?

I've been looking around and the examples and docs that I found are kind of outdated

hey @User there isn't an example for graphql at the moment. But we will work on one soon. In summary, you want to add a middleware that does session verification using our

verifySession

function and then fetch the user ID from that and attach it to the graphql context.

@User, we will have a graphql example within a few days.

Thanks, @rp . That's great to know

whats the best way to hide the signout button from the user if theyre not signed in?

@User you can check if a user is signed it or not like this: https://supertokens.io/docs/thirdpartyemailpassword/common-customizations/sessions/checking-session-front-end. If they are signed in, then you show the sign out button, else not

@User qr code login like telegram?

@aV we will add some version of it eventually. Just not sure when

@User I've tried https://supertokens.io/docs/thirdparty/common-customizations/sessions/checking-session-front-end

And it gives me an error, "Supertokens must be initialized first" or something

Right. Have you called the supertokens.init function? If yes, where do you call it? It should be one of the first things that happen on app load.

before rendering the

ThirdPartyAuth

component

I'm using thirdpartyauth in my index.js file

should it happen in there?