I am thinking of using the this registration flow for my site:
1) User registers by entering email and password.
2) Enter the email and hashed password into my database
3) I then construct an email with my url + jwt (contains e-mail and expires in 1 hour) string as a parameter.
4) User receives email and clicks on link.
5) Link sent to my server where I parse the parameter and check if the jwt is expired.
6) If not expired I then take the email and mark the account as validated in my database.
Are there any obvious holes in this approach which would leave to big vulnerabilities?