Magic code login method sends email when ACCOUNT_EMAIL_UNKNOWN_ACCOUNTS is False about django-allauth HOT 3 CLOSED

It's unclear to me why you would want to send a magic login link

It is not doing that... it is sending a "Hey, you don't have an account" mail. This (sending, or pretending to send) is needed to prevent account enumeration, and is good UX in case the user really thought he had an account but in fact did not.

from django-allauth.

Yes, I see. The account enumeration protection I understand.

I was thinking about the abuse case of an attacker using your site to send emails to a bunch of other people, spamming them to sign up to your site. That's not a new problem, though. It's the same challenge as password resets, hence using the same code, which makes sense.

And features like ACCOUNT_LOGIN_BY_CODE_MAX_ATTEMPTS help to guard against the abuse case, while preserving the use cases. Fair enough!

from django-allauth.

Fixed via 6206296

from django-allauth.