Thanks, @mindreframer! This looks really useful! I’ll give it a try in the coming weeks once I’m a bit freer with my project deadlines.
gushonorato
gushonorato
Release 0.2.1 – Security Fix 
Hey everyone! I’ve just released Magic Auth v0.2.1. It includes a security fix, so I strongly recommend updating as soon as possible.
Security
Fixed a way around the rate limits on login attempts and one-time password requests. Changing the case of the email (e.g. User@example.com instead of user@example.com) gave the same address a fresh limit. That made brute forcing the code feasible and let an attacker flood the user’s inbox.
Enhancements
Rate limiting now uses Hammer. Each email gets its own time window instead of all limits resetting at the same moment. The countdown on the verification page now refers to the email being verified.
Fixes
mix magic_auth.install now adds MagicAuthHooks to the hooks already declared in app.js, such as the hooks: {...colocatedHooks} generated by Phoenix 1.8. Before, it asked you to add it manually.
Upgrading
There are no breaking changes this time, and you don’t need any migrations or config changes. Just bump the version in mix.exs:
{:magic_auth, "~> 0.2.1"}
and run:
mix deps.update magic_auth
Check the Changelog for all the details.
Thanks for your support, and let me know if you have any feedback! 
0