3 ms·
What if someone did confirm the email address after they received the email? Now they can take over your account at any point in time.
by iopq 10y ago
What if someone did confirm the email address after they received the email? Now they can take over your account at any point in time.
- cstejerean 10y agoConfirming the email requires logging in. If you are already logged in then your session might be sufficient, but if you open the confirmation link on another device (like your phone) it will ask you to log in.
- officialjunk 10y agoAnd then request a password reset email to take over.
- koliber 10y agoThere are ways of handling this well. I'll address two common situations: If the site uses the email address as the primary identifier and there is no separate username, it is OK if someone confirms a mistyped email address. In such situations, an account should not be created until the email address is confirmed. Let's say matt@gmail.com is sitting in front of the computer and creates an account for mattt@gmail.com. mattt@gmail.com confirms the email address and is now the owner & controller of that user account. matt@gmail.com does not have access to that account, nor did he get a confirmation email. Ideally, he will realize something is wrong and will try creating the account again. If the site uses a username, and the email is just a contact method, the process of confirming the email address should ask the user to re-enter the password.