riverrun / phauxth_installer

No longer maintained - Installer for the Phauxth authentication library
13 stars 4 forks source link

Downcase & trim emails #17

Open michaeljones opened 4 years ago

michaeljones commented 4 years ago

Problem

I have issues on my project where users have used capitals in their email address when signing up but then failed to reproduce those capitals when logging in. This result in them seeing 'invalid credentials' and then resetting their password but it still doesn't work.

Solution

I think the default code should downcase & trim emails before inserting them into the database and subsequently searching for them in the database.

Perhaps an alternative would be to use case-insensitive fields in the database.

Additional info

I don't know what the best practice is for these system so I'm not sure if this is the best idea. I realise that people should be able to consistently type their own email address but email addresses are also case insensitive (I believe) and mobile phones tend to auto capitalise things. Hmm, now that I look at ait, I'm not actually marking my input field as 'type=email` so that might be part of it too.

riverrun commented 4 years ago

Thanks for raising the issue. I will look into it and get back to you soon.

riverrun commented 4 years ago

Ok. I have finally got round to looking at this - many apologies for the delay.

I did some research about this, and it seems that there are various conflicting opinions about this. One of the problems is that although emails are generally case insensitive, the username part of the email is technically case sensitive - see here for more info.

If you do decide to lowercase the email, there is also a difference of opinion on how best to do it. If you are using PostgreSQL, using citext seems to be the favored option - this post about storing emails in a Rails app provides more information about how to do this.

For the installer / example app, I think the best option is to add a comment in the Accounts module pointing to this issue, so that developers can make their own decisions based on their circumstances.

If you have any questions / comments, please let me know.