How to reset a user's password before email verification?

Question

I'm designing a basic registration and login system.

The site sends a confirmation email on registration with a 6-digit OTP.

Of course, it is possible that a user does not complete this email verification step.

Suppose later the user attempts to login. It seems the user should be able to login with their username+password, and then be prompted again to verify their email.

However, what if they have forgotten their password? It seems there are a few choices here:

1. Send a password reset link to the unverified email
2. Disallow a password reset (and the user can never login)
3. Disallow a password reset, and make the verification part of the registration process, thereby deleting the user if the email verification is not completed in time.
4. Something else?

One might attempt to circumvent this by having an "email verification link" rather than an OTP, but the email verification link can (and probably should) have an expiration date, after which we have the same problem.

Answer 1

The purpose of verifying email

• If the user has entered the correct email ID or not
• To eliminate the issues related to the forgotten password

There are two ways to solve the above issues.

• Option 01: Make verifying email a mandatory process during sign up flow -> This makes the process more robust. But at the same time annoying for the users as well. However, it is recommended to make it a mandatory step if your product conveys some important information through email. E.g payment gateway heavily depends on email communication. Without verifying email sign up should fail in this case. Enable users to resend the email if they don't receive the verification email.
• Option 02: Make it optional --> Gives user more control.

Assuming you are opting for option 02, clearly, we would be facing the above problems related to verifying emails.

Let's discuss the solutions that you are proposing.

• Send a password reset link to the unverified email -> This won't work. What if the registered email is all wrong? Sometimes some typo problem happens or the typed email is of someone else, but not of the user, yet still a valid one and yet to be registered on your product platform.
• Disallow a password reset (and the user can never login) -> Won't prefer this. This will lead to more drop-offs because of annoying experiences. This will affect your product sales.
• "Disallow a password reset, and make the verification part.." -> This is just too much for the user. The user only asked for resetting the password and we are overloading the user with a lot of things here.

Something Else/Solutions

• Allow users to sign up for the service.

• Ask the user to verify the email. They can always skip this process.

• Allow the user to explore the features of the platform, but display a prominent message to verify email on each of the pages. Have options to resend the email again. In case the email ID is all wrong, enable the user to change the email ID from the account setting. You can inform the user about the same in your verified email content. This will solve the problems related to if the user has entered the correct email ID or not.

• For any feature that needs mandatory email verification, prompt the user to do so immediately.

• Enable cookies to remember the password for some duration. Within that duration prompt user to verify email first.

• Towards the end of the duration, display the message even more prominently.

• If enabling cookies is not possible, I would prefer to go for the phone number+otp verification process for the signup process instead of email ID.

• Once they sign up for the service, prompt them to enter their Email ID. Re-ward users in some way if they do so. Apply the Gamification concept here. And then prompt the user to verify the email as well.