New answers tagged identity
Email verification doesn't provide extra security. It just validates than the newly registered user is the legitimate owner of that email address. For security concern a best practice for a web site would be not to send any email to an unconfirmed email address. This prevent leaking information to someone who mistyped his email address. Anyhow you ...
The purpose of the email verification for most services is to ensure user uniqueness (and thereby, hopefully, humanity) so that the provider can resist having many legions of spam accounts set up with ease (it's still possible, just more difficult). In getting a response, the service can then deny any future users from that email address from having a ...
Email verification stops spam and validates that user have this email. Before you send user an email message (or some confidental message like bank), you know that you are sending this message to this user, who has not mistaken in writing the adress, and nobody else.
Take a look at Keycloak (it is an identity broker). In particular, read their documentation on security vulnerabilities. I imagine you will also need something like Cross Origin Resource Sharing (CORS) - use CORS protocol rather than invent your own.
Top 50 recent answers are included