19

Our website uses a system where the username is the user's email address. We have a function which permits the user to change his email.

What is the best way to go about this?

  • Send an email only to the new email address just to confirm the change.
  • Send an email to both the new and the old email addresses for confirmation.
  • Send an email to the new address, asking the user to click a button for activation.
  • I'm open to any different suggestions as well.

I'm concerned about functionality, security and usability. There could be some problems with activation; for example, activating an email address that has been created between the change request and the changed email activation would certainly cause some problems. I'm probably forgetting other corner cases...

2 Answers 2

21

The most common way is to:

  1. Ask the user to enter her password before changing e-mail (even if she is currently logged in): this will help to avoid stealing of the account if user has forgotten to logout or somebody simply got user's cookies or something like this.

  2. Send an activation link to the new address and don't switch e-mails until the new one will be activated: this will ensure that user has entered the correct e-mail address she has access to.

9
  • 4
    Instead of step 2, you can make the change but send a notification to the previous email address with link provide to undo/reset the action if required. This removes a barrier for the majority of use cases (genuine change of email, not malicious).
    – Fractional
    Jun 6, 2014 at 13:33
  • 4
    @RedSirius but you will not be sure the new e-mail is valid in that case, and what if there is a typo in the e-mail address? Jun 6, 2014 at 14:08
  • 1
    You can still send a notification to the new address, just not require the activation step :)
    – Fractional
    Jun 6, 2014 at 15:09
  • 5
    @RedSirius What if the user is changing the email address because their old one has been hijacked?
    – dmur
    Jun 17, 2016 at 7:54
  • 2
    @PirateApp Could you please rephrase your thought process? I am a little bit confused. Why would the attacker not be able to login even if the new email address is owned by the attacker? You say: Ask for old password (to activate email change) > Enter new email > Send confirmation link to new email > Receiver clicks on the activation link in the new email > Now user has to log in again (implying that the old session was destroyed). How does this protect agains attacker if the attacker knows the old password and changes the email? It doesn't.
    – vaid
    Jul 25, 2020 at 12:01
1

In my opinion these steps should be secure and user friendly enough:

  1. Ask for password confirmation in the form to prevent other people to change the email address when someone forgot to logout.
  2. Send an email to the old email address to let the user know that is has been changed and offer the possibility to prevent or revert the change.
  3. Send an email to the new email address to verify the email address.
  4. When the user verifies the new email address, change the old email address to the new one but keep the old one in case it needs to be reverted. To check if the old email address is actually the previous one you should save it somewhere.
3
  • how does this work if your user used Facebook to login on your website and doesnt have a password?
    – PirateApp
    Nov 4, 2021 at 8:40
  • 1
    Good question, I would say that the user should confirm the change with their new email address and the user should still get a warning on their old email address and be able to revert te change I think. Do you have other suggestions? @PirateApp
    – Baspa
    Nov 4, 2021 at 9:30
  • the same point is applicable to the socially logged in user as well no? what if you are logged in and away from your workstation and someone else tries updating your email. in the case of normal login, you would ask for a password, what will you do here?
    – PirateApp
    Nov 4, 2021 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.