Gated Users still can get a JWT token

andrey.dzhezhora · 21 Jul 2022, 06:28

I enable the functionality of “Gate Users Until They Verify Their Email”
but even after doing step by step manual(https://fusionauth.io/docs/v1/tech/tutorials/gating/gate-accounts-until-user-email-verified) unverified email users still can get jwt token via API , anyone familiar with this strange behavior .?

dan · 16 Aug 2022, 03:05

@andrey-dzhezhora

Hmmm. What does the login API return as a status code. My guess, from reading the docs, is that it returns a 212, as specified here: https://fusionauth.io/docs/v1/tech/apis/login#authenticate-a-user

This is still a kind of success, and if you are using the Login API, you are expected to consume the response codes and make appropriate limitations based on that.

Does that make sense?

If, on the other hand, you are getting a 200 for this user, that seems like a bug. Or at least something is going on that I don't understand.