Open josecelano opened 5 months ago
Option 3:
Do not register the user until the email has been validated.
Option 3:
Do not register the user until the email has been validated.
- Ask the user to enter email.
- Send email to user: a. Send registration link, if unregistered. b. Send "you already have an account" email, if already registered.
- User completes registration, logs in, or reset password.
Option 3:
Do not register the user until the email has been validated.
- Ask the user to enter email.
- Send email to user: a. Send registration link, if unregistered. b. Send "you already have an account" email, if already registered.
- User completes registration, logs in, or reset password.
Hi @da2ce7 I think that is what the program does when email_on_signup
is Required
and email_verification_enabled
is true
. But currently it also tells you that the email is taken. We could simply allow duplicate emails, but a user could mistakenly write a wrong email which is valid. In that case, would be impossible to re-use that account (username).
@josecelano @da2ce7
I would do the following:
I also think it could do some more research on this topic and see how other apps implements it.
When you use an email that has already been used by another user you get a message like this:
That allows users to easily check is a user with a given email is registered. Although this is very common behavior in a lot of online services, for example, LinkedIn:
I think we should try to mitigate it.
Proposal 1
Add a captcha and/or a rate limit (IP) to the registration form to at least make it harder to automatize checking a list of emails.
Proposal 2
email_on_signup
. The email would be always optional.email_verification_enabled
option is enabled. The user's email is not used for anything else.Both proposals are compatible.
cc @torrust/torrustaceans