Package com.codename1.backend.security.mail

package com.codename1.backend.security.mail

What a server does by mail on a user's behalf: resetting a forgotten password and proving that an address is theirs.

Both mail a link carrying a token from OneTimeTokenService: 256 random bits that work once, for one purpose, until they expire. Only the token's SHA-256 is kept, so a copy of the table opens nothing.

• PasswordResetService mails the link and sets the new password; http.passwordReset(...) adds the two pages in front of it.
• EmailVerificationService mails the link and records the address as proved; http.emailVerification(...) adds the address the link opens.

A code mailed as a second factor at sign-in is EmailCodeService.

Everything here sends through MailSender, so it goes wherever cn1.mail.url says, and a test reads what was sent from MailSender.sent().

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.

Class	Description
EmailAddressResolver	Says where a user's mail goes.
EmailVerificationService	Proves that an address is a user's, by mailing it a link.
InMemoryOneTimeTokenRepository	Tokens kept in this process: gone when it stops, and unknown to any other server.
InMemoryVerifiedEmailRepository	Addresses kept in this process: gone when it stops.
JdbcOneTimeTokenRepository	Tokens kept in the server's database, in the cn1_one_time_token table of SecuritySchema.
JdbcVerifiedEmailRepository	Addresses kept in the server's database, in the cn1_verified_email table of SecuritySchema.
OneTimeTokenRepository	Where OneTimeTokenService keeps the tokens it has given out: never a token, only its hash.
OneTimeTokenService	Gives out tokens that work once: what a mailed link carries.
PasswordResetService	Resets a forgotten password by mail.
VerifiedEmailRepository	Where EmailVerificationService keeps each user's address and whether it has been proved.