4b04bd017d7a36d460447d8552ecaf9c8a33db4a
max
  Tue Aug 4 02:51:56 2026 -0700
hgLogin: gate email-link sign-in and change-email behind login.emailLink (default off), refs #37929

Also: GitHub/OIDC token-format and robustness fixes, signed pending-identity to close
an account-takeover hole in the OAuth account chooser, account chooser for the email-link
flow, idx-based chooser to avoid a utf8/latin1 collation error on non-ASCII usernames, and
login/signup page UI polish (consistent buttons, fonts, cache-busted stylesheet, forgot
links, wording). refs #37984

diff --git src/product/ex.hg.conf src/product/ex.hg.conf
index b089266bbab..00191bbf56b 100644
--- src/product/ex.hg.conf
+++ src/product/ex.hg.conf
@@ -167,30 +167,36 @@
 # name. In certain circumstances, this is not needed, e.g. when the genome browser
 # is always using https anyways. If the genome browser runs behind a reverse
 # proxy, this does not work at all, as the CGI does not know that the connection is 
 # already using HTTPs. In these cases, the following statement will not try to
 # redirect to HTTPS but just use a normal, relative link during/after the login
 #login.relativeLink=on
 
 # If you do not want to use our hgLogin but want to use HTTP Basic Authentication
 # (e.g. if you have usernames in an htpasswd file or want to use mod_auth_ldap and
 # validate users against an LDAP server), then you can activate this here.
 # login.basicAuth=on
 
 # Secret text string (like password) for generating and validating secure login key:
 login.cookieSalt=longSecretTextString
 
+# Offer a passwordless "Email me a sign-in link" option on the login page: the user gets a
+# one-time link by email that signs them in without a password.  This switch also controls
+# the "change email" option in the account menu.  Off by default; it needs working outbound
+# email (see login.mailReturnAddr above), so enable it only where that works.
+# login.emailLink=on
+
 # Optional social login buttons on the hgLogin signup and login pages.
 #
 # List the providers to offer, then give each one a block of settings.  A provider's button
 # appears only when both its clientId and clientSecret are set, so leaving these unset hides
 # it.  Register an OAuth 2.0 / OpenID Connect client with each provider and set its "redirect
 # URI" to your hgLogin URL exactly, e.g. https://yourbrowser.university.edu/cgi-bin/hgLogin
 # When a login supplies a verified email that matches an existing account, that account is
 # automatically linked to the new identity.
 #
 # For UCSC: clientId and clientSecret are secrets - put them in hg.conf.private, not here
 # (this file, hg.conf, is public).  The non-secret settings (the providers list, labels,
 # issuer/endpoints) can live in either file.
 #
 # login.oauth.providers=google,orcid,github,myuni
 #