mirror of
https://github.com/dreamhunter2333/cloudflare_temp_email.git
synced 2026-05-06 20:32:55 +08:00
e6cc8e2ffd
* feat: add Turnstile CAPTCHA for login forms (#767) Add optional Turnstile verification for admin login, user login, and address password login via ENABLE_LOGIN_TURNSTILE_CHECK env var. Does not affect existing Turnstile on address creation / registration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * docs: add ENABLE_LOGIN_TURNSTILE_CHECK to wrangler.toml.template Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: ensure openSettings loaded before admin login modal Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Turnstile to site access password and fix settings field name - Add Turnstile to site access password modal in Header.vue - Add /open_api/site_login endpoint for password + Turnstile verification - Fix settings field name from enableTurnstileLogin to enableLoginTurnstileCheck Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: move login endpoints to open_api/auth.ts Move /open_api/site_login and /open_api/admin_login from commom_api.ts to a dedicated open_api/auth.ts file for better code organization. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: change Turnstile check failure status from 500 to 400 Turnstile validation failure is a client error, not a server error. Change all Turnstile check error responses from 500 to 400. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: use unique IDs for multiple Turnstile instances When multiple modals with Turnstile appear simultaneously (e.g., site access + admin login), the hardcoded id="cf-turnstile" causes conflicts. Generate a unique container ID per Turnstile instance to fix this. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: review fixes - cfToken separation, register Turnstile, error codes - Separate cfToken refs in Login.vue to avoid token sharing between login and new address creation Turnstile instances - Add Turnstile check to user registration endpoint (not just verify_code) - Show Turnstile on register tab regardless of enableMailVerify - Pass cf_token in register request body - Fix site_login error message to use CustomAuthPasswordMsg - Fix verifyCode Turnstile error status from 500 to 400 - Restore empty line in commom_api.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: separate register Turnstile logic for with/without mail verify - With mail verify: verify_code already checks Turnstile, register skips Turnstile (token is one-time use) - Without mail verify: register checks Turnstile directly - Separate loginCfToken for login tab to avoid token sharing with register tab Turnstile Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add enableLoginTurnstileCheck to store defaults, simplify changelog Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: add /open_api/credential_login for credential login verification Add credential_login endpoint that verifies both Turnstile token and JWT credential server-side, replacing the generic verify_turnstile endpoint. Credential login now validates the JWT before accepting it. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: improve login endpoints - hash passwords, expose Turnstile refresh, fix status codes - site_login/admin_login: always called, verify hashed password + optional Turnstile - credential_login: always called, verify JWT + optional Turnstile - Frontend sends hashed passwords instead of plaintext - Turnstile component exposes refresh method via defineExpose - Fix Turnstile error status 500→400 in mails_api and telegram_api Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: rename to ENABLE_GLOBAL_TURNSTILE_CHECK and add isGlobalTurnstileEnabled helper - Rename ENABLE_LOGIN_TURNSTILE_CHECK -> ENABLE_GLOBAL_TURNSTILE_CHECK - Add isGlobalTurnstileEnabled() in utils.ts: checks env var + Turnstile keys all present - Backend settings returns enableGlobalTurnstileCheck computed from the helper - All backend endpoints use isGlobalTurnstileEnabled(c) instead of raw env check - Update all frontend refs, docs, changelog, and wrangler template Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * refactor: use utils.isGlobalTurnstileEnabled instead of named import Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: add E2E tests for turnstile login endpoints - Test all 3 new /open_api/* endpoints when ENABLE_GLOBAL_TURNSTILE_CHECK is disabled - Verify settings returns enableGlobalTurnstileCheck: false - Test admin_login with correct/wrong/empty hashed password - Test site_login returns 401 when no PASSWORDS configured - Test credential_login with valid JWT, invalid JWT, empty credential - Test address_login with empty cf_token works when turnstile disabled - Add ADMIN_PASSWORDS to E2E wrangler config for admin_login tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: rename test file to login-endpoints.spec.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: validate JWT payload has address field in credential_login Prevents user tokens or challenge tokens from being accepted as address credentials since they share the same JWT_SECRET. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: refresh Turnstile token on login failure to allow retry After a failed login attempt, the consumed Turnstile token is now refreshed so users can retry without manually refreshing. Also adds ref to signup Turnstile in UserLogin.vue to refresh after verification code is sent (single-use token consumed). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: separate Turnstile tokens for signup and reset password flows Split shared cfToken into signupCfToken and resetCfToken to prevent single-use Turnstile token conflicts between signup tab and reset password modal. Each flow now has its own token ref and refreshes the correct Turnstile widget after use. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: update comments from "login turnstile" to "global turnstile" Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Cloudflare Temp Email - Free Temporary Email Service
This project is for learning and personal use only. Please do not use it for any illegal activities, or you will be responsible for the consequences.
A fully-featured temporary email service!
- Completely Free - Built on Cloudflare's free services with zero cost
- High Performance - Rust WASM email parsing for extremely fast response
- Modern UI - Responsive design with multi-language support and easy operation
- Address Password - Support setting individual passwords for email addresses to enhance security (enabled via
ENABLE_ADDRESS_PASSWORD)
Deployment Documentation - Quick Start
Documentation | Github Action Deployment Guide
Changelog
See CHANGELOG for the latest updates.
Live Demo
Try it now → https://mail.awsl.uk/
Star History (Click to expand/collapse)
Table of Contents (Click to expand/collapse)
Core Features
Core Features Details (Click to expand/collapse)
Email Processing
- Use
rust wasmto parse emails, with fast parsing speed. Almost all emails can be parsed. Even emails that Node.js parsing modules fail to parse can be successfully parsed by rust wasm - AI Email Recognition - Use Cloudflare Workers AI to automatically extract verification codes, authentication links, service links and other important information from emails
- Support sending emails with
DKIMverification - Support multiple sending methods such as
SMTPandResend - Add attachment viewing feature with support for displaying attachment images
- Support S3 attachment storage and deletion
- Spam detection and blacklist/whitelist configuration
- Email forwarding feature with global forwarding address support
User Management
- Use
credentialsto log in to previously used mailboxes - Add complete user registration and login functionality. Users can bind email addresses and automatically obtain email JWT credentials to switch between different mailboxes after binding
- Support
OAuth2third-party login (Github, Authentik, etc.) - Support
Passkeypasswordless login - User role management with support for multi-role domain and prefix configuration
- User inbox viewing with address and keyword filtering support
Admin Features
- Complete admin console
- Create mailboxes without prefix in
adminbackend - Admin user management page with user address viewing feature
- Scheduled cleanup function with support for multiple cleanup strategies
- Get mailboxes with custom names,
admincan configure blacklist - Add access password for use as a private site
Multi-language & Interface
- Both frontend and backend support multi-language
- Modern UI design with responsive layout
- Google Ads integration support
- Use shadow DOM to prevent style pollution
- Support URL JWT parameter auto-login
Integration & Extensions
- Complete
Telegram Botsupport,Telegrampush notifications, and Telegram Bot mini app - Add
SMTP proxy serversupportingSMTPfor sending emails andIMAPfor viewing emails - Webhook support and message push integration
- Support
CF TurnstileCAPTCHA verification - Rate limiting configuration to prevent abuse
Technical Architecture
Technical Architecture Details (Click to expand/collapse)
System Architecture
- Database: Cloudflare D1 as the main database
- Frontend Deployment: Deploy frontend using Cloudflare Pages
- Backend Deployment: Deploy backend using Cloudflare Workers
- Email Routing: Use Cloudflare Email Routing
Tech Stack
- Frontend: Vue 3 + Vite + TypeScript
- Backend: TypeScript + Cloudflare Workers
- Email Parsing: Rust WASM (mail-parser-wasm)
- Database: Cloudflare D1 (SQLite)
- Storage: Cloudflare KV + R2 (optional S3)
- Proxy Service: Python SMTP/IMAP Proxy Server
Main Components
- Worker: Core backend service
- Frontend: Vue 3 user interface
- Mail Parser WASM: Rust email parsing module
- SMTP Proxy Server: Python email proxy service
- Pages Functions: Cloudflare Pages middleware
- Documentation: VitePress documentation site
Important Notes
- When adding domain records in Resend, if your DNS provider is hosting your 3rd level domain a.b.com, please remove the 2nd level domain prefix b from the default name generated by Resend, otherwise it will add a.b.b.com, causing verification to fail. After adding the record, you can verify it using:
nslookup -qt="mx" a.b.com 1.1.1.1