[security] Confirmation codes should expire

[andrewmclagan]

There is a security risk that confirmation codes to not expire.

1. MaliciousUser requests confirmation be sent.
2. MaliciousUser intercepts email
   • (yes this is really really easy)
   • (emails are plain text)
3. Email contains email address, userId and confirmation code.
4. MaliciousUser can now confirm.

[bestmomo]

Hi,
It's the same way for password reset.

[LucasLeandro1204]

I think it's not, because you have to login after confirmation. I don't care if someone confirm my email faster than me xd.

[andrewmclagan]

Wrong its really easy to write a bot to subscribe 10000 people. Then confirm them. Never assume that a security hole wont be exploited in the worst kinda way....

Your users will be spammed and you'll loose all their trust.

[andrewmclagan]

Laravel password resets expire.

[jeehag]

It's a real problem and can be security hole.