We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her account.
We can have 2 outputs, depending on which we have to give a confirmation message.
- User is registered but account is not active. Confirmation message will be
The activation link has been sent.
- User is registered and account is already active. Confirmation message will be
The account is already active. If you have forgotten your password, please click here.
We are having doubts about the second confirmation message. It tells too much about the fact that the account already exists. Are there best practices or security tips regarding these kinds of messages?
Or do you have any suggestions?
We have implemented a new solution. No matter the output, we will display the following message:
If you are registered, you will soon receive an email.
However, the email sent will depend on the output:
- If the account is not active, we will be sending the activation link.
- If the account is already active, we will be sending an email saying that the account is already active and explaining the "password forgotten" procedure.
This solution seems to be the most appropriate in our situation. If you have any other suggestions, please submit.