3

I have a simple website registration form that only asks for your email, the username you want, and the password you want. To make sure the email is real, we send a confirmation email to the entered email address, where users click a link to activate their account.

But what if the email address is not the real email of the user who's signing up?

Should other users be allowed to sign up with an email that had already been registered...but is not yet confirmed?

  • Yes

    A person registers for the website using their real email address, but doesn't check their email until later. Then, some guy registers using that same email. When the first person checks their email, they'll click on the first confirmation message that they see, and they'll unknowingly activate some other guy's account.

  • No

    Some guy registers using an email that isn't theirs. Then, the person who really owns the email address attempts to register for the website, but fails because the other guy has already used the email address (but it's not yet confirmed).

Improve this question

2 Answers 2

Reset to default
4

Yes.

The "confirm email" is a side channel mechanism to confirm you own the email address.

If someone else tries to use an email address that they don't own (either by accident or maliciously), that should have no bearing on the user who actually owns the address.

You are basing your trust on the fact that a user can access the email address, that is all you need to worry about. I.e. don't worry about people who do not have access to the email address.

EDIT - "Don't worry" is incorrect. You may want to worry about what happens if someone receives a confirmation email (which they didn't initiate) and accidentally clicks on it. Make sure the 'malicious' user doesn't have access to the account. Either mitigate it by having a timeout, or ask for password / shared secret after confirmation etc.

Improve this answer
1
  • 1
    This. When user uses the confirm button, it should take him right into your service, but every other connection should be revoked.
    – rojcyk
    Commented Aug 31, 2016 at 15:47
1

Yes they should be able to.

Most confirmation emails, much like rest password email, are valid for 24 hours. If you don't confirm it then your account is not verified.

"Then, some guy registers using that same email." After 24 hours that email has become available again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.