0

In my system, a new user must confirm his email.

But there is an edge case:

  • he registers
  • does not confirm
  • forgets password, performs password reset (which involves a mail loop)

At that point I know his email works - so I'm inclined to reset his password, and then simply mark his email as "confirmed".

Are there any risks I've not considered?

Improve this question
1
  • 1
    The logic seems fine to me.
    – yeah_well
    Commented May 9, 2019 at 21:55

1 Answer 1

Reset to default
2

No added risks if you use the same communication protocol to/from user's email, your database, or any other part in these two cases, I.e at the point of registering and at the "forgot password" steps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .