Go relying-party verifier for the Email Verification Protocol (EVP).
EVP lets a browser present a cryptographic proof that the user controls an email address without sending a verification email. This package verifies the server-side token submitted by the browser.
Experimental. EVP is still a draft protocol and Chrome's origin trial behavior may change. Keep this library behind a feature flag until the protocol settles.
This package verifies EVP tokens. It does not:
- create users
- issue application sessions
- send fallback emails
- implement OAuth or OpenID Connect
- implement an EVP issuer
Create a verifier:
verifier, err:=evp.New(evp.Config{
Origins: []string{"https://example.com"},
})
iferr!=nil {
// handle error
}Begin a verification attempt and render the nonce into the form:
begin, err:=verifier.Begin()
iferr!=nil {
// handle error
}
// Store begin.Session in a server-side session or signup intent.// Render begin.Nonce into the hidden input's nonce attribute.<inputname="email" type="email" autocomplete="email"><inputname="email_verification_token"
type="hidden"
autocomplete="email-verification-token"
nonce="{{ .EVPNonce }}">Finish verification after form submission:
result, err:=verifier.Finish(ctx, evp.FinishOptions{
Email: submittedEmail,
Token: submittedToken,
Session: savedSession,
})
iferr!=nil {
// fall back to your existing email verification flow
}
// result.Email is verified for this EVP attempt.EVP proves control of an email address. It is not a replacement for an application session, password, passkey, invite gate, or account-linking policy. Applications should treat success as "this email address was verified" and then apply their own account and session rules.