18 lines
510 B
Plaintext
18 lines
510 B
Plaintext
local claims = {
|
|
email_verified: false
|
|
} + std.extVar('claims');
|
|
|
|
{
|
|
identity: {
|
|
traits: {
|
|
// Allowing unverified email addresses enables account
|
|
// enumeration attacks, especially if the value is used for
|
|
// e.g. verification or as a password login identifier.
|
|
//
|
|
// Therefore we only return the email if it (a) exists and (b) is marked verified
|
|
// by GitHub.
|
|
[if "email" in claims && claims.email_verified then "email" else null]: claims.email,
|
|
},
|
|
},
|
|
}
|