Website User Email Verification & OTP Security
by Hi Spark Solutions https://www.hisparksolutions.com/$ 57.81
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
Discuss (mail)
• Website (website) |
| Lines of code | 452 |
| Technical Name |
hispark_email_verification |
| License | OPL-1 |
| Website | https://www.hisparksolutions.com/ |
| Versions | 16.0 17.0 18.0 19.0 |
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
Discuss (mail)
• Website (website) |
| Lines of code | 452 |
| Technical Name |
hispark_email_verification |
| License | OPL-1 |
| Website | https://www.hisparksolutions.com/ |
| Versions | 16.0 17.0 18.0 19.0 |
|
|
||||
⬡ Odoo Website Security Module
Hi Spark — Email Verification
|
|
2
Auth Modes
|
SHA-256
OTP Hashing
|
60s
Resend Cooldown
|
24h
Default Expiry
|
|
Verification Architecture Complete Authentication FlowEvery path from signup through login to verified access — OTP and link modes end to end.
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
What's Inside
Designed Around Real Security
Every feature exists because of a real threat model — not checkbox compliance.
SHA-256 Hashed OTP Storage
The raw 6-digit code is never persisted. Only its SHA-256 hash is stored — plaintext is gone the moment it's sent.
Dual Verification Modes
OTP (user types a 6-digit code) or Link (user clicks a tokenised URL). Both share the same secret — switchable without code changes.
Configurable Expiry Window
Both OTPs and links expire after a configurable number of hours (default 24h). Controlled via Validation Expiration (Hrs) in Website Settings.
Attempt-Based Blocking
Wrong OTP submissions increment a per-user counter. When the configured maximum is hit (default 3), the user is blocked to the error/resend page.
60-Second Resend Cooldown
The resend route checks otp_last_sent on the user record. Requests within 60 seconds are rejected, preventing OTP-flood attacks.
Intercepts Signup & Login
New users caught at /web/signup. Existing unverified portal users intercepted at /web/login post-auth and sent through the same flow.
Portal-Only Enforcement
System/admin users bypass verification entirely via _is_system(), keeping your Odoo backend operations completely unaffected.
Enable / Disable Toggle
Set to OTP, Link, or Disable from Website → Configuration → Settings. When re-enabled, all unverified users must verify on next login.
Admin Manual Verification
Administrators can flip verified = True directly from the backend user form — no email flow required — for edge cases or support.
Branded Email Templates
One mail.template powers both modes — OTP block or link button. Company logo, name, phone, and email auto-populated via QWeb.
Theme-Compatible UI
All verification pages extend web.login_layout, inheriting your active Odoo website theme. No custom CSS overrides required.
Anti-Bot Registration
Automated signups that don't control the registered inbox are silently dead — they complete the form but can never complete verification.
|
Step by Step Six Steps to Verified AccessFrom form submission to confirmed identity — the complete user journey. 01
User Submits Signup or Login The module intercepts the POST request before Odoo grants session access. Credentials are validated by the parent controller first. 02
OTP Generated & Hashed A cryptographically secure 6-digit code via secrets.randbelow(). SHA-256 hash, expiry, and attempt counter written to the user record. 03
Verification Email Sent Email shows OTP code in a styled box, or a tokenised verification button. Company branding applied automatically via QWeb. 04
User Verifies Their Identity OTP mode: user enters the 6-digit code. Link mode: user clicks the button. Both routes check expiry and attempt count first. 05
Hash Comparison & Outcome Submitted value hashed and compared to stored hash. Match → verified=True. No match → otp_attempt++, error shown. 06
Redirect to Login On success, redirected to /web/login with confirmation message. Session email cleared. Account permanently marked verified. |
Admin Configuration
Three Settings. Total Control.
Website → Configuration → Settings. Stored as Odoo system parameters.
| Setting | Options | Default | Behaviour |
|---|---|---|---|
| Signup Verification Method | OTP Verification Link Verification Disable | OTP | Controls verification path for all new signups and existing unverified logins. Disable removes all verification gates. |
| OTP Allow Failed Attempts | Integer | 3 | Max wrong OTP submissions before the user is blocked to the error/resend page. Visible only when OTP mode is selected. |
| Validation Expiration (Hrs) | Integer (hours) | 24 | How long an OTP or verification link stays valid after generation. Hidden when mode is set to Disable. |
|
Screenshots See It in ActionTested and verified on Odoo Enterprise Edition.
✓ Tested and verified on Odoo Enterprise Edition
|
Hi Spark Solutions
Our Services
End-to-end Odoo expertise — from implementation to ongoing support.
Get In Touch
For any query or support contact us without hesitation on Visit Website Contact Form
support@hisparksolutions.com | Contact Support
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module