In my system, a new user must confirm his email.

But there is an edge case:

  • he registers
  • does not confirm
  • forgets password, performs password reset (which involves a mail loop)

At that point I know his email works - so I'm inclined to reset his password, and then simply mark his email as "confirmed".

Are there any risks I've not considered?

  • 1
    The logic seems fine to me.
    – yeah_well
    May 9 '19 at 21:55

No added risks if you use the same communication protocol to/from user's email, your database, or any other part in these two cases, I.e at the point of registering and at the "forgot password" steps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.