Signup: protect passwordless signup with Blackbox - #113300
Open
Usiel wants to merge 4 commits into
Open
Conversation
|
WordPress.com
Automattic for Agencies
|
Usiel
force-pushed
the
usielriedl/blackbox-signup
branch
from
August 6, 2026 05:01
95f42ad to
1e2bc5a
Compare
matticbot
added
the
[Status] Needs Review
Usiel
marked this pull request as ready for review
August 6, 2026 05:02
Contributor
Author
|
Tests will fail due to dependency on backend changes. |
|
Looks like one of the E2E tests has failed. You can fix them following these steps:
|
Load the Blackbox client in `PasswordlessSignupForm` behind a new `blackbox-signup` feature flag: render the challenge container, block submit while the SDK initializes, and attach `blackbox_session_id` to the `/users/new` request. The standalone path (no flow name, parent-owned submit — Jetpack Connect signup and logged-out invite accept) hands the session ID off through the `submitForm` payload. `handlePasswordlessSubmit` now forwards an `afterSubmit` callback so those parents can report the request outcome; on failure the form resets Blackbox so a retry gets a fresh, verifiable session.
The button below already has sufficient padding, we just need to get a gap to the username input.
Both screens of the social-first signup stay mounted and are hidden via CSS visibility stacking, so the challenge widget (which sets its own visibility inside a closed shadow root) bled through onto the selection screen and consumed a session before email was even picked. Add a `suspended` flag to `useBlackboxProtection` (exposed as a `blackboxSuspended` prop by `withBlackboxProtection`) and gate each stacked `PasswordlessSignupForm` on its screen being active. `useBlackbox` now sets loading when enabled after mount and clears blocking state when suspended mid-challenge.
Cover the /start/account, Jetpack Connect, and invite-accept signup surfaces against the three Blackbox verdicts (allow, challenge, block). These specs fail until 232387-ghe-Automattic/wpcom is merged: the server-side signup changes on the `/users/new` endpoint live in that PR, so until it ships the signup itself fails.
Usiel
force-pushed
the
usielriedl/blackbox-signup
branch
from
August 7, 2026 03:20
1e2bc5a to
6f31970
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Load the Blackbox client in
PasswordlessSignupFormbehind a newblackbox-signupfeature flag: render the challenge container, block submit while the SDK initializes, and attachblackbox_session_idto the/users/newrequest.The standalone path (no flow name, parent-owned submit — Jetpack Connect signup and logged-out invite accept) hands the session ID off through the
submitFormpayload.handlePasswordlessSubmitnow forwards anafterSubmitcallback so those parents can report the request outcome; on failure the form resets Blackbox so a retry gets a fresh, verifiable session.Depends on server-side changes 232387-ghe-Automattic/wpcom. Also, note the protection is disabled for
production.jsonright now via the feature flag.