verify user account on sign-up

fac-14 / sleuth-coop

An online network connecting local government and SMEs.

https://sleuth-sme.herokuapp.com/

2 stars 1 forks source link

verify user account on sign-up #158

Closed sunuwars closed 5 years ago

sunuwars commented 5 years ago

when a user submits form to sign-up, they will be emailed a link with token in the provided email.

when they click-on that link (received in the email), the email is verified.

BenNewman90 commented 5 years ago

For the record, this is outside the scope of this sprint.

SleepySheepy172 commented 5 years ago

@sunuwars Ben is right it is important to focus on the features in this document before doing anything extra. Those are the features we have promised will be finished at the end of this sprint and the features they are paying for, if they want anything else done, that can be agreed on for a different sprint.

sunuwars commented 5 years ago

I thought this is a 'given' when a user signs up with an email account , I've seen it being verified everywhere(ensure the account actually exists and it belongs to the person) . If we do not check this and let people go ahead registering non-existent/mis-typed , valid form of email (robots can do that) when it comes the time of password reset/forgot-password they will not have the means to retrieve the account and maybe someone who an email actually belongs to will be unable to register here with their email if someone registered with their address beforehand The reset password which is the document listed functionality is affected by this

SleepySheepy172 commented 5 years ago

I see your point but this is not expected to behave as a final polished product.

I think we can trust people trialing the site to enter their email correctly (if we want we could always add a warning under the original email input telling them to be sure they've entered the correct email)
bots are an unlikely situation that I really don't think we need to worry about yet

The short of it is that they specifically asked for email password reset, so the basic functionality of that should be the main focus. Email verification is not essential to email password reset working, it would be nice to have but it's a secondary concern.