{"record":{"id":"d05ee9d757235b09","repo":"gitroomhq/postiz-app","slug":"email-with-plus-sign-is-not-allowed","errorCode":null,"errorMessage":"Email with plus sign is not allowed","messagePattern":"Email with plus sign is not allowed","errorType":"error_code","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"apps/backend/src/services/auth/auth.service.ts","lineNumber":44,"sourceCode":"      process.env.DISABLE_REGISTRATION !== 'true' ||\n      provider === Provider.GENERIC\n    ) {\n      return true;\n    }\n\n    return (await this._organizationService.getCount()) === 0;\n  }\n\n  async routeAuth(\n    provider: Provider,\n    body: CreateOrgUserDto | LoginUserDto,\n    ip: string,\n    userAgent: string,\n    addToOrg?: boolean | { orgId: string; role: 'USER' | 'ADMIN'; id: string }\n  ) {\n    if (provider === Provider.LOCAL) {\n      if (process.env.DISALLOW_PLUS && body.email.includes('+')) {\n        throw new Error('Email with plus sign is not allowed');\n      }\n      if (body instanceof CreateOrgUserDto) {\n        body.email = body.email.toLowerCase();\n      }\n      const user = await this._userService.getUserByEmail(body.email);\n      if (body instanceof CreateOrgUserDto) {\n        if (user) {\n          throw new Error('Email already exists');\n        }\n\n        if (!(await this.canRegister(provider))) {\n          throw new Error('Registration is disabled');\n        }\n\n        const create = await this._organizationService.createOrgAndUser(\n          body,\n          ip,\n          userAgent","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/gitroomhq/postiz-app/blob/0f1647f7491a217d43eb5ae7a480484bdf0aff3e/apps/backend/src/services/auth/auth.service.ts#L26-L62","documentation":"Signup guard that rejects LOCAL provider registrations when the email contains a '+' and the DISALLOW_PLUS env var is set. Plus-addressing (user+tag@domain.com) can be used to create multiple accounts from one mailbox, so some deployments disable it.","triggerScenarios":"POSTing to /auth with provider=LOCAL while DISALLOW_PLUS is truthy and body.email includes '+'.","commonSituations":"Operator set DISALLOW_PLUS=true to prevent abuse; users who legitimately use Gmail-style plus addressing then cannot register.","solutions":["Register with an email without a '+' alias","Unset or remove DISALLOW_PLUS from the environment if plus-addressing should be allowed","Strip or normalize plus-addressed emails before submitting"],"exampleFix":"# before\nDISALLOW_PLUS=true\n\n# after\nDISALLOW_PLUS=","handlingStrategy":"validation","validationCode":"const email = 'user+tag@example.com';\nif (process.env.DISALLOW_PLUS && email.includes('+')) {\n  throw new Error('Choose an email without a plus alias');\n}\nawait signup({ email });","typeGuard":"const isPlusFreeEmail = (email: string) => !email.includes('+');","tryCatchPattern":null,"preventionTips":["Normalize/strip plus aliases client-side when the deployment disallows them","Document the DISALLOW_PLUS policy on the signup form"],"tags":["auth","email-validation","signup","env-var"],"backgroundTag":"email-validation-failed","analyzedSha":"0f1647f7491a217d43eb5ae7a480484bdf0aff3e","analyzedAt":"2026-08-27T12:09:55.020Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}