I have a system that requires unique email addresses for registering and it verify that email using a verification link that we send to that address. In a situation like one person register with an email and waiting for it to click on the verification link, should I prevent other users to choose that email? What happened if I preventing them to choose that email and the older person never verifies that email? That email address would be not accessible to everyone and yet not in the system as well. What is the best approach is for this situation?
5
-
1Is this a frequent problem for your system? I can't imagine why another user would attempt to signup using an existing email address within the system. Family users who share an email or malicious attempts, maybe?– AlanJan 3, 2018 at 21:13
-
@Alan one situation is like someone register in this system with many email addresses and not verify them so a long list of emails are not accessible anymore, and they might be anyone's email address– dev-masihJan 3, 2018 at 21:16
-
Many email addresses is different than multiple registrations on a single email. If I'm misunderstanding please let me know.– AlanJan 3, 2018 at 21:55
-
2@Alan I think the OP is worried that someone malicious will try to "bulk register" loads of email addresses (either generated randomly, or trawled from somewhere), which will go to "needing verification" state and thus preventing the real owners from registering. If this is the right interpretation, the obvious answer would be to "forget" any unverified email address after some period (e.g. 24 hours).– TripeHoundJan 4, 2018 at 10:09
-
@TripeHound Ah, interesting. Now I'm curious as to how large products handle this.– AlanJan 4, 2018 at 17:37
Add a comment
|
3 Answers
IMO Email addresses are supposed to be unique for a single person. Of course, the same person can have multiple email addresses in their name, but a purticular address should only belong to one user.
When it comes to your question, the best practice is to block the user from re-registering with the same email address. If they try to register with a previously given email address, the system should notify the user, with a message similar to something shown below.
Image credit goes to the following link.
The scenario is, most systems use the email address as a unique identifier for a user in it. So restricting it will give you benefits such as simpler application logic, personalization for each user and so on.
I think that once an account is created with an email address, that email address is blocked from other registrations whether it's verified or not. If it falls into the wrong hands, the rightful owner can always take control by changing the password.
No do prevent sending a verification link again to the same email address. Sending a verification link should not register that email address as in use.
Your system needs to keep track of the state of the email address.
Your database stores the email address, some data that correlates to the verification link, and the state.
The 'pending' state is when a verification link has been sent out.
Once the link is followed, you change the state to 'verified'. And of course you do any other processing, for example assigning the email address to an account, ...
In the 'pending' state you must allow requests to resend a verification link. You already have a record for this email address in your database. You just need to update the field with the data that correlates to the link.
