Email verification permanently disabled: isEmailVerified hardcoded to true on registration

[anshul23102]

Summary

In backend/controllers/authController.js, the user creation block unconditionally sets isEmailVerified: true with an inline comment acknowledging this is a temporary workaround:

isEmailVerified: true, // skip email verification until SMTP is configured

This means:

• Anyone can register with any email address (including addresses they do not own).
• The email verification flow (verifyEmail, resendVerificationEmail) is fully implemented but unreachable in practice.
• There is no mechanism to ensure a user owns the email they registered with.

Impact

• Account enumeration: an attacker can register with victim@company.com and use the account.
• Reputation: malicious users register with real-looking email addresses for social engineering.
• Data integrity: user profiles contain unverified email addresses used for contact and notifications.

Suggested Fix

Configure an SMTP provider (Resend, Postmark, or Nodemailer with a real account) and remove the hardcoded bypass:

// Remove this line:
isEmailVerified: true,

// Replace with:
isEmailVerified: false,
emailVerificationToken: crypto.randomBytes(32).toString('hex'),
emailVerificationExpires: new Date(Date.now() + 24 * 60 * 60 * 1000),

Then call sendVerificationEmail after user creation.

[anshul23102]

@Canopus-Labs Could you please assign this issue to me? I'd like to work on it under GSSoC '26.
/assign
/claim

[anshul23102]

Hi Canopus-Labs team,

I have implemented the fix for this critical security issue and submitted PR #2265 with a comprehensive email verification system.

The solution addresses all concerns from the issue:

1. Email verification is now mandatory on registration
2. Verification tokens are generated securely (32-byte random + SHA-256 hash)
3. Tokens expire after 24 hours
4. Login is blocked until email is verified (403 Forbidden response)
5. Verification email sent immediately on registration
6. All existing verification endpoints now functional

The implementation prevents account enumeration, ensures users own their emails, and maintains audit trails for all verification attempts. No breaking changes to existing API contracts.

Would you please review and consider adding the gssoc-approved label when you merge?

/review