Currently working with our web designer on a website and encountered the following issue when using the partial locker.
When we create a new post and use the partial locker to ‘hide’ more of an article in the post visitors to the website need to login to read the full article. If they have an account/registered they can do so by putting their email address in.
Am I wrong to think that by ‘just logging in with an email address’ this could cause a fundamental security breach and the owners open themselves up for liability issues (loss/breach of personal data)?
For example if I know that someone is registered on the website and have their email address I can use this to access their account? Alternatively say the website is called yourname.com – if it contains contact us/about us page with details of the editor and his/her email address wouldn’t you use that to login?
Is this a COMPLETE failure of this website template or are we missing something?
Hi,
To clarify, the users don’t have this grant access to a user account or personal data. The email field is used as part of a verification process (such as a magic link or access token sent to that email). Simply knowing someone’s email address is not enough to gain access.
Lockers – https://forum.tagdiv.com/lockers/
If access were granted immediately without any verification, that would indeed be a serious security issue. This is therefore not a failure of the website template.
Thank you!
