Re:Hosting Provider Leaked 63M Records Including Magento and...
by tialaramex on Thursday November 05, 2020 @07:57PM
(#25003804)
For email verification it's less scary if that was really all you wanted.
If you believe you're verifying that the email went to your user, this isn't enough. Lots of systems parse URLs out of emails and follow them, you probably want to look for a a pre-existing session cookie, or insist the user log in from the verification page and confirm this is what they wanted.
Otherwise you've merely got two unrelated facts:
1. Some user of your system (maybe happy_pancake) says [email protected] is their email address
2. Mail to [email protected] is received by a machine or person which reads web pages.
It would be foolish to conclude from these facts that happy_pancake is actually [email protected] or that [email protected] wants to use your service.
If you believe you're verifying that the email went to your user, this isn't enough. Lots of systems parse URLs out of emails and follow them, you probably want to look for a a pre-existing session cookie, or insist the user log in from the verification page and confirm this is what they wanted.
Otherwise you've merely got two unrelated facts:
1. Some user of your system (maybe happy_pancake) says [email protected] is their email address
2. Mail to [email protected] is received by a machine or person which reads web pages.
It would be foolish to conclude from these facts that happy_pancake is actually [email protected] or that [email protected] wants to use your service.