fr: Remove challengeless registration in standard builds #2071

New issue

Closed

opened 2026-07-29 11:31:06 +00:00 by nex · 1 comment

nex commented

2026-07-29 11:31:06 +00:00

Owner

There is never a legitimate reason to permit challengeless registration outside of a debug environment, especially the easily automated legacy registration. We have already supported recaptcha for a long time, and the support for email is also now settled. We already prevent this situation during server setup, but I believe we should remove the option altogether in standard builds, and instead require a compile-time feature to enable the option. This prevents people deliberately making their servers insecure without committing to it.

There is never a legitimate reason to permit challengeless registration outside of a debug environment, especially the easily automated legacy registration. We have already supported recaptcha for a long time, and the support for email is also now settled. We already prevent this situation during server setup, but I believe we should remove the option altogether in standard builds, and instead require a compile-time feature to enable the option. This prevents people *deliberately* making their servers insecure without committing to it.

👍 4

nex added the

Enhancement

Matrix/Administration

Matrix/Client

Matrix/Auth

labels

2026-07-29 11:31:06 +00:00

stratself referenced this issue

2026-08-16 09:44:06 +00:00

docs: Authentication/Registration page(s) #2140

stratself commented

2026-08-16 10:36:48 +00:00

Member

This will probably make require_email_for_registration redundant

This will probably make [`require_email_for_registration`](https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/conduwuit-example.toml#L2179) redundant

nex referenced this issue from a pull request that will close it,

2026-08-26 17:03:21 +00:00

feat: Disable challengeless registration in release mode #2189

nex closed this issue

2026-08-26 18:36:01 +00:00