1

I could just put "Email:" field into "Edit profile" form (that is the form to edit current user information) of my site.

But this way it is possible that a user both changes the email in a wrong way and forgets his password. Then he would become unable to restore the password, because password restoration at my site requires sending email to the user.

What is the proper workflow (or workflows?) to change user's email?

6

Changing email is not allowed by some of the web applications due to security reasons. Some of the apps which allow this uses the following workflow:

  1. You present the editable section where the user can update the email address.
  2. Once the user changes the email, a confirmation email is sent to the new email address which contains a link to verify the email address. Note that you don't update the email address in database till now.
  3. Once the user verifies the email using the link sent to the new email address, you update the email address in your backend. Also, note that the link has an expiry time. Beyond the expiry time, the link becomes useless.
  4. As a security measure, you send an email to the old email address which contains a message about the action which is performed recently. Along with the message, you share a help/support link for the user to contact you in case of the action was not performed by him.
  5. If the user contacts you about the unauthorized action in his account, you verify the critical information related to the user and then takes necessary action.

This is how you update the user email address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.