Skip to content

docs(eveonline): explain character transfer sign-in handling #593

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nijel merged 1 commit into from
Oct 20, 2026
Merged

docs(eveonline): explain character transfer sign-in handling #593

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions docs/backends/eveonline.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,4 +35,24 @@ The EVE Single Sign-On (SSO) works similar to GitHub (OAuth2).

SOCIAL_AUTH_EVEONLINE_SCOPE = ['publicData']

Character transfers
-------------------

EVE characters can move between player accounts. This backend checks the
``CharacterOwnerHash`` returned by EVE SSO against the hash saved with an
existing ``CharacterID`` association. If the hashes differ, sign-in fails with
``identity_in_use``; the transferred character cannot access the previous
owner's local account.
Comment on lines +41 to +45

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Do not claim transfer protection before it is released

In the repository's configured documentation environment, pyproject.toml:4 pins social-auth-core[all]==6.1.1, whose EVEOnlineOAuth2 backend stores owner_hash but does not compare it during sign-in; the referenced social-core PR #2137 is not part of that release. Publishing this unqualified guarantee therefore tells operators that a transferred character cannot access the previous owner's account even though the supported release remains vulnerable. Coordinate this documentation with a core release and dependency update, or clearly state the minimum version that implements the check.

Useful? React with 👍 / 👎.


To let the new owner sign in, an administrator must verify the transfer and
remove the old social-auth association. The new owner can then sign in with the
character and create or link their own local account. Preserve access to any
other identities and data on the previous owner's local account when removing
the association.

An older association without a saved ``owner_hash`` records the hash from its
next successful sign-in. Because that row has no evidence of the previous
owner, review such rows before relying on this backfill in sensitive
deployments. Sign-in fails if EVE SSO omits ``CharacterOwnerHash``.

.. _EVE Developers: https://developers.eveonline.com/
Loading