I have a system that requires unique email addresses for registering and it verify that email using a verification link that we send to that address. In a situation like one person register with an email and waiting for it to click on the verification link, should I prevent other users to choose that email? What happened if I preventing them to choose that email and the older person never verifies that email? That email address would be not accessible to everyone and yet not in the system as well. What is the best approach is for this situation?
I think that once an account is created with an email address, that email address is blocked from other registrations whether it's verified or not. If it falls into the wrong hands, the rightful owner can always take control by changing the password.
No do prevent sending a verification link again to the same email address. Sending a verification link should not register that email address as in use.
Your system needs to keep track of the state of the email address.
Your database stores the email address, some data that correlates to the verification link, and the state.
The 'pending' state is when a verification link has been sent out.
Once the link is followed, you change the state to 'verified'. And of course you do any other processing, for example assigning the email address to an account, ...
In the 'pending' state you must allow requests to resend a verification link. You already have a record for this email address in your database. You just need to update the field with the data that correlates to the link.
IMO Email addresses are supposed to be unique for a single person. Of course, the same person can have multiple email addresses in their name, but a purticular address should only belong to one user.
When it comes to your question, the best practice is to block the user from
re-registering with the same email address. If they try to register with a previously given email address, the system should notify the user, with a message similar to something shown below.
Image credit goes to the following link.
The scenario is, most systems use the email address as a unique identifier for a user in it. So restricting it will give you benefits such as simpler application logic, personalization for each user and so on.