Skip to content

feat(registration): add email domain whitelist policy#724

Merged
Wei-Shaw merged 2 commits intoWei-Shaw:mainfrom
PMExtra:feat/registration-email-domain-whitelist
Mar 4, 2026
Merged

feat(registration): add email domain whitelist policy#724
Wei-Shaw merged 2 commits intoWei-Shaw:mainfrom
PMExtra:feat/registration-email-domain-whitelist

Conversation

@PMExtra
Copy link
Contributor

@PMExtra PMExtra commented Mar 2, 2026

  1. 新增管理员系统设置,邮箱域名白名单,限制只允许指定的邮箱后缀,可以一定程度防止批量注册。(留空则允许任意邮箱)
image
  1. 注册账号时,如果输入的邮箱不在白名单内,则显示提示。
image
  1. 该功能只影响常规注册,不影响 管理员创建用户 或者 OAuth 等登录方式。

@PMExtra
Copy link
Contributor Author

PMExtra commented Mar 4, 2026

@Wei-Shaw 能否评审一下这个PR,主要场景是减少恶意的大批量注册。

尤其是在 #706(新用户可以自动获得默认订阅)之后,为了避免用户大规模注册账号薅免费试用。
通过限制邮箱后缀,就可以借助外部的QQ/GMail对于注册账号的风控,提升用户批量注册账号大规模薅订阅的门槛。

@Wei-Shaw
Copy link
Owner

Wei-Shaw commented Mar 4, 2026

image 处理一下冲突先

@Wei-Shaw
Copy link
Owner

Wei-Shaw commented Mar 4, 2026

gmail存在多种变种情况 比如:test@gmail.com
test.1@gmail.com
test.2@gmail.com
test@googlemail.com
test+hi@gmail.com

@PMExtra PMExtra force-pushed the feat/registration-email-domain-whitelist branch from 1c09d9c to bd0801a Compare March 4, 2026 05:59
@PMExtra
Copy link
Contributor Author

PMExtra commented Mar 4, 2026

@Wei-Shaw gmail 变体的问题,我考虑到了。

我预期的处理方式是,在用户表加一个 normailized_email 字段并建立索引,把邮箱做归一化:

  • 删除所有 .
  • 正则替换 \+.*@@
  • 替换 @googlemail.com@gmail.com
  • 转换为全小写

然后在注册时,把输入的邮箱也同样归一化,再去用户表比对。

因为这个改动比较大,而且新增字段还要对现有数据做 migration 。

所以我打算当前 PR 合并后再另起一个 PR 来做这个事。

@PMExtra PMExtra marked this pull request as draft March 4, 2026 06:16
@PMExtra PMExtra marked this pull request as ready for review March 4, 2026 06:20
@Wei-Shaw Wei-Shaw merged commit 27abae2 into Wei-Shaw:main Mar 4, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants