-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
For now the user is logged in automatically after registration and the email is not valid.
The purpose here would be to send a registration link at the registered email to validate the user (before the user should not be able to log in).
This also prevent the current email leakage. Indeed, we are currently returning a 409 (Conflict) error when reusing email. If we have the email validation system, we can just indicate to the user that a validation link was sent. If the email already exist, the email suggest the user to change its password, otherwise, the email includes the registration link. This way, a malicious user can't discover emails.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels