| layout | title | date | categories |
|---|---|---|---|
post |
Stateless Email Verification |
2014-04-18 03:20:50 -0700 |
security stateless |
My preference has always been stateless approach, but the approach mentioned needs a bit more work. You want the link to expire in some time - so when you generate the signature, you append a timestamp into it as well.
Stateless email verification should be something like this -
- Make a JSON Object with {"email": "[email protected]", "timestamp": "1395139162"}
- Base64 encode JSON Object with URL Safe Encoder. Call the string as "payload"
- Compute a signature, which is SHA1(payload + secret key). MD5 is also fine for this purpose.
- Generate a link - https://example.com/verify_email?payload=&signature= and email the user.
- When the user clicks the link, extract the payload and verify the signature. If signature mismatch - raise hell
- Extract timestamp and verify it hasn't expired
- Finally, confirm the email. Optionally, log in the database when the email was confirmed.