Sylius: Possible Data Protection issue with guest accounts

[euperia]

I think there may be a security issue using guest accounts.

Take the following scenario:

1. Bob places an order as a guest (using [email protected]). Bob does not create an account.
2. Alice then registers with Bob's email address and creates a password.
3. Alice logs in and sees Bob's order history, address, telephone number etc

This is mitigated somewhat if the option to verify registrations by email is enabled. However, as this can deter some users from purchasing its likely that store owners would disable this.

If Alice had a long list of email addresses she could check them against the XHR endpoint that is used on the checkout page. She could then create accounts for any email addresses that don't have accounts and log in. She might get lucky and get access to user data.

This issue is related to this: https://github.com/Sylius/Sylius/issues/6883

[pamil]

As for now, our recommendation would be to keep email verification turned on (that's the default). We'll add an appropriate tooltip to the channel management that explains this issue so that no one turns it off without knowing the consequences.

Currently, we assume there's only one customer for a given email so that we can't really unassign them on the case-by-case basis. We could mitigate that by adding a unique constraint on the customer for both email and user, instead of email only, so that registered customer could not see the orders made by an unregistered customer with the same email before.

As for the XHR endpoint, even without it, it could be checked easily by sending the registration form.

[stale[bot]]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.