- Shipped
- September 4, 2026 at 8:18 PM UTC
- Author
- Kamo
- Commit
- f67a839
/verify-email-change spends the token in a change-of-address letter and says what happened. It lives here rather than in the workspace because the letter goes to a PERSONAL mailbox — usually read on a phone that has never signed into the workspace, and often not signed into anything. login.<domain> is the one host that always resolves for an organization and never needs a session, so it is the only place the link is certain to work for the person who most needs it. Nothing on the page asks for anything. It arrives, spends the token, and reports — a form here would be a form the reader cannot fill in from the mailbox they opened. The spend is guarded against React's development double-invoke, because the token is single-use and a second call would spend it and then report the success as "this link is no longer valid". The relay beside /api/recover and shaped the same way: SecurityService is ClusterIP-only, so it goes over cluster DNS, which makes Host the service name and puts the browser's hostname in X-Forwarded-Host — the only header the backend reads it from.