3 ms·

This allows anyone to use the mail service account to send spam.

by Canada 5y ago

omarfarooq 5y ago
From the site: > All email services require some sort of authentication to send the emails on your behalf. That makes it a really bad idea to use them directly from client-side – revealing your password or your secret keys will allow anyone to send emails on your behalf. EmailJS keeps your authentication details on the server-side, and the client-side code just triggers a predefined email template, similarly to how any client-server application is working. also, > Additionally, we've also developed various tools to prevent abuse – for instance, we have IP based rate limits to prevent bots from spamming, the whitelist of origin, and also support reCAPTCHA tests to make sure that a human is sending the email (although it's up to the developer to turn this feature on).
- ealexhudson 5y ago
  The homepage claim is that no server-side code is required to integrate it - so this seems to allow anyone to rock up on your website, call into the EmailJS service, and trigger an email? Given that EmailJS doesn't send email directly - it only sends through the accounts (e.g. Gmail) you've connected - this feels like a recipe for getting your email account shut down rapidly. If your template allows a variable destination (i.e. you can set To: from client-side) and there's enough latitude in the template, I don't see anything stopping people spamming through this service beyond the "abuse measures" like IP rate limiting.
  - omarfarooq 5y ago
    They say so themselves: > Personal email services allow connecting personal email providers that offer basic email functionality – an email address and an inbox. These include providers like Gmail, Fastmail, Outlook 365, etc'. Personal email services are useful in EmailJS when you need to send a small number of emails to yourself, or need to send emails to other people from your personal email account. Note, your personal email account could be blocked if you go over the daily limit of the email provider, and your email address could be flagged as spam if you send unsolicited emails to multiple recipients. Our general recommendation is to use personal email services only for development purposes or for very low volume usage. Source: https://www.emailjs.com/docs/tutorial/adding-email-service/ https://www.emailjs.com/docs/tutorial/adding-email-service/
    - ealexhudson 5y ago
      Yeah, but they state it in quite non-obvious terms: "you might hit the rate limit", or "you could be flagged as spam if you send to multiple recipients". The real risk is that someone finds this script on your website, open, and abuses it for themselves. Which is exactly what spammers already do, from the old sendmail.pl scripts to current vulnerable Wordpress extensions. If an external actor finds this and abuses it, that will be a world of pain. Worse, if someone was specifically trying to target you for some hurt, the ability to send emails they control directly from your personal account?! There is so much damage you could do with that ability..
q-rews 5y ago
So just like any contact form? The API does not expose a “to” field, did you even open the page?
- Aeolun 5y ago
  If the API does not expose a to field, what exactly is the point? Seems like you need to use a template field to modify the ‘to’ field, but that would still require you to pass the template value in the request.
  - mnahkies 5y ago
    It seems like this is aimed at use cases like a contact form hosted on something like GitHub pages - where you're limited to a static site, and assuming you don't want to run your own server side handler. I have one site that is generated by Gatsby that could conceivably use this instead of the php script I currently have setup to handle the contact form.
emailjs 5y ago
This is a misconception.

This allows anyone to use the mail service account to send spam.

by Canada 5y ago

This allows anyone to use the mail service account to send spam.

From the site: > All email services require some sort of authentication to send the emails on your behalf. That makes it a really bad idea to use them directly from client-side – revealing your password or your secret keys will allow anyone to send emails on your behalf. EmailJS keeps your authentication details on the server-side, and the client-side code just triggers a predefined email template, similarly to how any client-server application is working. also, > Additionally, we've also developed various tools to prevent abuse – for instance, we have IP based rate limits to prevent bots from spamming, the whitelist of origin, and also support reCAPTCHA tests to make sure that a human is sending the email (although it's up to the developer to turn this feature on).

ealexhudson 5y ago
The homepage claim is that no server-side code is required to integrate it - so this seems to allow anyone to rock up on your website, call into the EmailJS service, and trigger an email? Given that EmailJS doesn't send email directly - it only sends through the accounts (e.g. Gmail) you've connected - this feels like a recipe for getting your email account shut down rapidly. If your template allows a variable destination (i.e. you can set To: from client-side) and there's enough latitude in the template, I don't see anything stopping people spamming through this service beyond the "abuse measures" like IP rate limiting.
- omarfarooq 5y ago
  They say so themselves: > Personal email services allow connecting personal email providers that offer basic email functionality – an email address and an inbox. These include providers like Gmail, Fastmail, Outlook 365, etc'. Personal email services are useful in EmailJS when you need to send a small number of emails to yourself, or need to send emails to other people from your personal email account. Note, your personal email account could be blocked if you go over the daily limit of the email provider, and your email address could be flagged as spam if you send unsolicited emails to multiple recipients. Our general recommendation is to use personal email services only for development purposes or for very low volume usage. Source: https://www.emailjs.com/docs/tutorial/adding-email-service/ https://www.emailjs.com/docs/tutorial/adding-email-service/
  - ealexhudson 5y ago
    Yeah, but they state it in quite non-obvious terms: "you might hit the rate limit", or "you could be flagged as spam if you send to multiple recipients". The real risk is that someone finds this script on your website, open, and abuses it for themselves. Which is exactly what spammers already do, from the old sendmail.pl scripts to current vulnerable Wordpress extensions. If an external actor finds this and abuses it, that will be a world of pain. Worse, if someone was specifically trying to target you for some hurt, the ability to send emails they control directly from your personal account?! There is so much damage you could do with that ability..

q-rews 5y ago

So just like any contact form? The API does not expose a “to” field, did you even open the page?

Aeolun 5y ago
If the API does not expose a to field, what exactly is the point? Seems like you need to use a template field to modify the ‘to’ field, but that would still require you to pass the template value in the request.
- mnahkies 5y ago
  It seems like this is aimed at use cases like a contact form hosted on something like GitHub pages - where you're limited to a static site, and assuming you don't want to run your own server side handler. I have one site that is generated by Gatsby that could conceivably use this instead of the php script I currently have setup to handle the contact form.

emailjs 5y ago

This is a misconception.