check that email exists

[bourgeoa]

The user should respond to an email to be able to validate a new email/password login entry.

Or
An unknow password could be set by the server and the user should be in charge of changing it.
A list of accounts waiting for validation should be available to admins

[thhck]

The user should respond to an email to be able to validate a new email/password login entry.

Or
An unknow password could be set by the server and the user should be in charge of changing it.
A list of accounts waiting for validation should be available to admins

I think the validation link is the best option.

Also, we need:

• choose and implement a mail sender either:

  • with a node lib like Nodemailer
  • with a 3rd party server, like mailgun

• create a key value store with verification status, with accountId as keys, and as values a verification token, a ttl , a isVerified boolean

• override CreateAccountHandler so it doesn't resolve to a login, but redirect to a waiting page, generate a new verif. token and create a new entry in the verification status store.

• Create a "wait for validation page", with a button to resend the validation email

• create a validation endpoint ( /validate/<accountId>/<token> )

  • the endpoint should use the above Store to change isVerified to true if the token match

• override ResolveLoginHandler to check if the accountId is verified, otherwise return an error. The client should handle the error by redirecting to the waiting page, so the user can send another verification email.

[thhck]

hmm I'm wondering if there is an issue in using the accountId, in the /validate/ url, if it is an security issue if a user accountId is leaked.

Maybe we can use hash instead, just to be sure.

[bourgeoa]

choose and implement a mail sender either:

This already exist and used for password recovery.
We should also use the same logic ?