{
  "id": 10207969,
  "title": "Email verified is not authorization",
  "url": "https://urgent.news/2026/09/27/email-verified-is-not-authorization",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T12:03:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/authbyexample1/email-verified-is-not-authorization-3j6p"
  },
  "original_language": "en",
  "account": null,
  "summary": "Verifying an email address strengthens identity. It does not decide what that identity may do. A user who clicked the confirm link is still only authenticated. They may still lack permission for that document, tenant, or admin action. Treating \"email verified\" as \"allowed\" skips the real check. Authorize on the server for every sensitive request: subject, action, and the specific resource. Keep…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}