starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-25 13:55:59 +03:00

[token] #166

New issue

Closed

opened 2026-02-26 18:45:40 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 18:45:40 +03:00

Owner

Originally created by @raj-saroj-vst-au4 on GitHub (Oct 30, 2023).
Original GitHub issue: https://github.com/documenso/documenso/issues/607

Issue Description

The route or page /sign/[token] is unprotected.

Steps to Reproduce

Create a new document by uploading > add signers > add fields > add subject > send
From the /documents page > click on 'sign' for the doc
From the /sign page, copy the full url viz. https://app.documenso.com/sign/[token]...
From browser, Open a new incognito window and paste the url

Expected Behavior

Should've redirected to / or login route

Current Behavior

Allows unauthenticated user to sign

Screenshots (optional)

Environment

OS: Deepin OS
Browser: Brave
Version: latest

Checklist

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.

Originally created by @raj-saroj-vst-au4 on GitHub (Oct 30, 2023). Original GitHub issue: https://github.com/documenso/documenso/issues/607  ## Issue Description The route or page /sign/[token] is unprotected. ## Steps to Reproduce 1. Create a new document by uploading > add signers > add fields > add subject > send 2. From the /documents page > click on 'sign' for the doc 3. From the /sign page, copy the full url viz. https://app.documenso.com/sign/[token]... 4. From browser, Open a new incognito window and paste the url ## Expected Behavior Should've redirected to / or login route ## Current Behavior Allows unauthenticated user to sign ## Screenshots (optional) ![image](https://github.com/documenso/documenso/assets/54412653/1e09d3be-752b-4287-8704-867586918e85) ![image](https://github.com/documenso/documenso/assets/54412653/eab2ab7e-368a-4a9a-a0fa-ec1425d0350b) ## Environment - OS: Deepin OS - Browser: Brave - Version: latest ## Checklist   - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution.

kerem closed this issue

2026-02-26 18:45:41 +03:00

kerem commented

2026-02-26 18:45:41 +03:00

Author

Owner

@catalinpit commented on GitHub (Oct 30, 2023):

Hello @raj-saroj-vst-au4, thanks for bringing this to our attention! However, this is the intended behavior. People should be able to sign a document with an account as well.

@catalinpit commented on GitHub (Oct 30, 2023): Hello @raj-saroj-vst-au4, thanks for bringing this to our attention! However, this is the intended behavior. People should be able to sign a document with an account as well.

kerem commented

2026-02-26 18:45:41 +03:00

Author

Owner

@raj-saroj-vst-au4 commented on GitHub (Oct 31, 2023):

But unwanted or random unathenticated people can also also sign my document & my dashboard shows status completed.

@raj-saroj-vst-au4 commented on GitHub (Oct 31, 2023): But unwanted or random unathenticated people can also also sign my document & my dashboard shows status completed.

kerem commented

2026-02-26 18:45:41 +03:00

Author

Owner

@Mythie commented on GitHub (Oct 31, 2023):

But unwanted or random unathenticated people can also also sign my document & my dashboard shows status completed.

That would require them knowing the signing token which would be incredibly hard unless a recipient leaked it prior to signing.

@Mythie commented on GitHub (Oct 31, 2023): > But unwanted or random unathenticated people can also also sign my document & my dashboard shows status completed. That would require them knowing the signing token which would be incredibly hard unless a recipient leaked it prior to signing.

kerem referenced this issue

2026-02-26 18:48:50 +03:00

[PR #166] [MERGED] update: add new brand color as palette in tailwind config #770

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#166

No description provided.

Rows
Columns