Security Issue: User Impersonation

Hi, yes I got it to work. You can try the flow from the user perspective at climesumer.com.

Here is what I did:

  1. I use a Softr Form as the first signup and create a user in Softr using Make.
    This tutorial: Internal apps and client portals: how to automate the user creation with Make.com.
    This allows me to automatically create a user and store the magic link in my Airtable base.
  2. Using an Airtable formula I append a “verify email page” (with a button) to that magic link.
  3. Using a status field (with verified, not verified) and views, I have an Airtable automation the gets triggered when a new user is created.
    An email is sent to the new user with the magiclink+verify_page.
  4. When they click the link they get directed to a verify email page. That page has just one button which actually is a form with hidden fields, recording the user name.
    When clicked, it changes the user status field to verified.

That’s it.

Hope it helps. Let me know if anything is unclear.

1 Like