Situation

Currently only an administrator is able to change the user mail address

Wanted

A user shall be able to change his/her email address via REST.
The process shall ensure that the user has access to the mail address.

Solution

Should also work with go client
The process shall be similar to the registration process

REST:

1. User request mail change over web-ui or go client with initial authenticated request:
   POST /api/mamangement/user/email/
   body={newEmail}
2. SecHub Server checks request and sends verification link to new mail address (link valid for 24h)

• generates JWT token
• encrypts new email address
• sends link: POST /user/change-email?accessToken=&email=
• URL must be open to unauthenticated

3. When user verifies the new mail, the mail is changed by the server
4. The user is redirected to the login page (the Go client might ignore/ open browser)
5. A notification is send to the old mail address