feat(webapp): only accept a magic link in the browser that requested it

Magic links now only sign you in from the browser that requested them.
Opening a link anywhere else, including when an email security scanner
follows it, no longer logs anyone in or creates an account. If you open
a link in a different browser or on another device, you'll be asked to
request a new one there.

Self-hosted instances can allow opening links on another device by
setting `MAGIC_LINK_SAME_BROWSER_REQUIRED=false`.

Mono-RevId: 20c50ae2200654ace852d8f68afb8435e83c2d30

Author: ericallam

.server-changes/magic-link-same-browser.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Magic links now only sign you in from the browser that requested them, so a link opened elsewhere (including by an email security scanner) no longer logs anyone in. Self-hosted instances can turn this off with `MAGIC_LINK_SAME_BROWSER_REQUIRED=false`.

apps/webapp/app/env.server.ts

@@ -412,6 +412,7 @@ const EnvironmentSchema = z
     WEBAPP_TELNET_LOGS_PORT: z.coerce.number().optional(),
     LOGIN_ORIGIN: z.string().default("http://localhost:3030"),
     LOGIN_RATE_LIMITS_ENABLED: BoolEnv.default(true),
+    MAGIC_LINK_SAME_BROWSER_REQUIRED: BoolEnv.default(true),
     APP_ORIGIN: z.string().default("http://localhost:3030"),
     PUBLIC_APP_ORIGIN: z.url().optional(),
     // Extra exact origins (comma separated) added to the document `img-src` CSP,

apps/webapp/app/services/emailAuth.server.tsx

@@ -62,6 +62,15 @@ const emailStrategy = new EmailLinkStrategy(
     secret,
     callbackURL: "/magic",
     sessionMagicLinkKey: "triggerdotdev:magiclink",
+    /**
+     * A magic link only signs in from the browser session that requested it. Without this,
+     * anything that opens the link signs in, including the link scanners corporate mail filters
+     * run on incoming email, so a request typed with someone else's address created an account.
+     * Development is exempt: there `sendMagicLinkEmail` redirects straight to the link before the
+     * strategy has stored it in the session.
+     */
+    validateSessionMagicLink:
+      env.NODE_ENV !== "development" && env.MAGIC_LINK_SAME_BROWSER_REQUIRED,
   },
   verifyMagicLink
 );

docs/self-hosting/env/webapp.mdx

@@ -44,6 +44,7 @@ mode: "wide"
 | `WHITELISTED_EMAILS`                             | No       | —                     | Whitelisted emails regex.                                                                                          |
 | `BLOCKED_EMAIL_DOMAINS`                          | No       | —                     | Comma-separated email domains that can't sign in or sign up, including their subdomains.                           |
 | `LOGIN_RATE_LIMITS_ENABLED`                      | No       | true                  | Enable rate limiting on magic-link login.                                                                          |
+| `MAGIC_LINK_SAME_BROWSER_REQUIRED`               | No       | true                  | Only accept a magic link opened in the browser that requested it. Set to false to allow opening it on another device.|
 | `AUTH_GITHUB_CLIENT_ID`                          | No       | —                     | GitHub client ID.                                                                                                  |
 | `AUTH_GITHUB_CLIENT_SECRET`                      | No       | —                     | GitHub client secret.                                                                                              |
 | `CSP_IMG_SRC_ALLOWLIST`                          | No       | —                     | Extra hosts the dashboard may load images from, e.g. an SSO or avatar host serving profile images. A comma-separated list of exact origins (`https://sso.example.com`); a wildcard host such as `https://*.example.com` is refused. |

hosting/docker/webapp/docker-compose.yml

@@ -58,6 +58,7 @@ services:
       DIRECT_URL: ${DIRECT_URL:-postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/main?schema=public&sslmode=disable}
       SESSION_SECRET: ${SESSION_SECRET}
       MAGIC_LINK_SECRET: ${MAGIC_LINK_SECRET}
+      MAGIC_LINK_SAME_BROWSER_REQUIRED: ${MAGIC_LINK_SAME_BROWSER_REQUIRED:-true}
       BLOCKED_EMAIL_DOMAINS: ${BLOCKED_EMAIL_DOMAINS:-}
       ENCRYPTION_KEY: ${ENCRYPTION_KEY}
       PROVIDER_SECRET: ${PROVIDER_SECRET}