4

I have a website where users login with their email address and password.

They also can update their account details like first and last name, location and email address. If they make a typo while updating their email, what's the best way to let them recover their account?

Improve this question
2
  • 2
    I guess there is a confirmation email, so until that email is confirmed the email address won't update; is this correct?
    – Alvaro
    Mar 12, 2017 at 19:32
  • @Alvaro Well at this point, there isn't. Let's say there is. The confirmation email might be sent to someone else. What if that person clicks the confirmation link? I guess it's a good idea the password is needed too to confirm the email address?
    – Thoaren
    Mar 12, 2017 at 20:39

1 Answer 1

Reset to default
7

Typically two confirmation emails should be sent:

One email should be sent to your old email address ("You asked us to change your email address") which would allow you to revert the change if it wasn't you that did it, or you changed your mind, or you made a typo.

One email should be sent to the new email address asking you to authenticate with your password.

The account change should not happen until the authentication has happened with the new email and the password. Until then, the old email address is still registered on the account.

On your site it would be advisable to put a banner e.g. 'A confirmation email has been sent to [email protected] (change this)' so that users can see the new address clearly, and let the user correct the new email address in the event a typo has been made. If the new email address is updated to something new again, then authentication via the incorrect intermediate address should not be allowed. The banner would remain until the authentication has been made from the new email or reverted via the old email, or cancelled on the site.

[Disclaimer: I'm not a security expert!]

Improve this answer
3
  • 1
    I implemented this in my website and it works great! This solution gives a better security to my users for not losing their account. Thanks Roger!
    – Thoaren
    Apr 4, 2017 at 10:44
  • It also provides better security for people who are not users. You'd be surprised how many people in the world who share my last name sign up for stuff with my e-mail address (which is my last name at a very large e-mail provider). Some of them probably just don't have an e-mail, others probably forgot that the address they wanted was already taken and they picked a different name.
    – uliwitness
    Sep 2, 2017 at 13:38
  • (Related: I get a lot of spam from web sites aforementioned people have signed me up for, and I hate those sites for not properly checking whether someone actually owns an address before letting people associate an account with it)
    – uliwitness
    Sep 2, 2017 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.