I am writing a web app and I want to set up a system where, when a user changes their email, it gives them a link to have the change revert back. The purpose of this is for when a hacker changes an account email. In this case the user can't log in without it being reverted. Login is email + password.
I need to handle a hacker doing multiple changes trying to use up a revert list. And I don't want the ability to revert by just entering an email as that would allow major mischief by hackers. So I came up with the following. Will this work? Is there a better approach?
- On an email change, I create a GUID and then save in the DB the GUID, old email, and old password hash.
- The email sent to them lists the change and says to revert click the link. The link has the GUID in it.
- Upon receiving that link, it reverts back to the previous email & password hash.
- If possible (I'm using Blazor server), it will log out any other sessions for this user.
- Should I then force them to use 2FA?
- Nightly clean-up will delete any revert records that are over a month old.
Will this work? Any security holes?
Based on the below replies (thank you) then what about the following? (Asking here because I don't think it's worth a distinct new question.)
When it is changed, send an email to the old & new email with a GUID & link. Clicking that link, which has the GUID as a parameter, asks if they want the account disabled and provides the support phone & email for them to call.
That way we stop any further damage and then turn it over to human beings to figure out what to do.
I am not selecting an answer from the below as the accepted answer because I think several of the answers make very good points and I don't know this topic well enough to select which is best.