Feature Request: Whitelisting OTP Email whitelisting #1678

New Issue

MrUnknownDE · 2026-04-05T19:39:13+02:00

MrUnknownDE commented

2026-04-05 19:39:13 +02:00

Originally created by @jimmy-ck on 3/25/2025

Pangolin shows the user who is trying to insert a non-whitelisted email that the email is not whitelisted explicitly. This opens the door to try out multiple addresses and get a potential positive feedback if they are whitelisted or not.
I prefer Cloudflare's approach of just showing the user in general that OTP password has been sent but only actually sends the OTP in the background, if the address is whitelisted.

What do you think about that?

https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/

By design, blocked users will not receive an email. The login page will always say A code has been emailed to you, regardless of whether or not an email was sent.

*Originally created by @jimmy-ck on 3/25/2025* Pangolin shows the user who is trying to insert a non-whitelisted email that the email is not whitelisted explicitly. This opens the door to try out multiple addresses and get a potential positive feedback if they are whitelisted or not. I prefer Cloudflare's approach of just showing the user in general that OTP password has been sent but **only** actually sends the OTP in the background, if the address is whitelisted. What do you think about that? [https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/](https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/) > By design, blocked users will not receive an email. The login page will always say A code has been emailed to you, regardless of whether or not an email was sent.

MrUnknownDE closed this issue

2026-04-05 19:39:13 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1678