delight-im / PHP-Auth

Authentication for PHP. Simple, lightweight and secure.
MIT License
1.09k stars 235 forks source link

Register user only after verification #262

Closed ZateLabClients closed 1 year ago

ZateLabClients commented 3 years ago

If someone user a fake mail Id to register and he left without verification of that email. Later the actual user cant register with that mail ID . It will show "User already exists"

This is the problem. Can anyone help me?

ocram commented 3 years ago

Thank you!

In the UserAlreadyExistsException exception block of your Auth#register call, could you try an Auth#resendConfirmationForEmail call there, right inside of the exception block?

That would probably look something like this:

try {
    $userId = $auth->register($_POST['email'], $_POST['password'], $_POST['username'], function ($selector, $token) {
        // TODO: Send '$selector' and '$token' to the user (e.g. via email)
    });

    // TODO: Signed up a new user with the ID '$userId'
}
catch (\Delight\Auth\InvalidEmailException $e) {
    die('Invalid email address');
}
catch (\Delight\Auth\InvalidPasswordException $e) {
    die('Invalid password');
}
catch (\Delight\Auth\UserAlreadyExistsException $e) {
    try {
        $auth->resendConfirmationForEmail($_POST['email'], function ($selector, $token) {
            // TODO: Send '$selector' and '$token' to the user (e.g. via email)
        });

        // TODO: The user may now respond to the confirmation request (usually by clicking a link)
    }
    catch (\Delight\Auth\ConfirmationRequestNotFound $e) {
        die('User already exists');
    }
}
catch (\Delight\Auth\TooManyRequestsException $e) {
    die('Too many requests -- try again later');
}

If that works for you, we could certainly think about adding this directly into the library, so that Auth#register does this automatically.