This release closes a form-security gap that could have let attackers send email through our domain to third parties, and fixes a regional email misco
Corey Alan 0.12.2Corey Alan Consulting 0.12.2 |
This release closes a form-security gap that could have let attackers send email through our domain to third parties, and fixes a regional email misconfiguration that was routing UK messages through the wrong account and key. • Form submissions are now protected by a secure, server-issued token instead of a client-supplied one • Contact forms no longer send confirmation emails to unverified addresses supplied in the request • The support form now has the same anti-abuse protection as other forms • Fixed a bug where the spam-trap field on dynamic forms wasn't working • Fixed regional email routing so UK (and other non-US) messages use the correct sending domain and account |
New Added anti-abuse protection to the support form The support form previously had no protection against automated abuse; it now uses the same server-issued token as other forms. |
|
Fixed Closed a security gap in form token validation Forms previously relied on a client-generated token that could be spoofed. Tokens are now issued and verified by the server using HMAC, preventing forged submissions. |
Stopped emailing unverified addresses from form submissions Contact submissions were sending an acknowledgment email to whatever address was included in the request, even if unverified — allowing our sending domain to be used to mail strangers. This acknowledgment has been removed. |
Fixed the honeypot field on dynamic forms The spam-trap field was posting a hardcoded empty value instead of functioning correctly, weakening its effectiveness against bots. |
Fixed regional email sending domains Email configuration was pointing at bare domains that failed authentication and didn't match any region's account list, causing UK traffic to incorrectly use the US sending account and key. Regional configs now point to the correct provisioned sending domains for each region. |
|
Where it's live Web — live
You're receiving this because you subscribed to Corey Alan Consulting product updates. Unsubscribe |
|
|
