functions-samples
functions-samples copied to clipboard
Bugfix : Ensure emailVerified is not set to true in Spotify Auth sample
Problem
In the Spotify Auth sample, customToken.emailVerified was incorrectly set to true by default.
However, Spotify API does not verify user emails. This creates a potential security vulnerability.
Solution
- Updated
functions/index.jsto ensureemailVerifiedis either unset or explicitly set to false. - Tested the flow to confirm that emailVerified is not marked as true.
Reference
Fixes #1154