Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Registration: Do no expose email is taken, instead send "account exists" notice #375

Open
Brutus5000 opened this issue Jan 16, 2025 · 3 comments

Comments

@Brutus5000
Copy link
Member

Currently the registration form reveals if an account for a certain email exists or not. This contradicts our security measure on password reset where we do not reveal if an email is in use.

So instead of telling the user, that the email is taken instead we should do the following:

  • Send an email on to the given email address
  • Put in the actual username and the desired username
  • Mention the "no double account rules"
  • Contain a link to email password recovery (with prepopulated email address - new feature)
  • Contain a link to rename account feature
@Ivan-Shaml
Copy link

Ivan-Shaml commented Jan 18, 2025

Break down into smaller tasks:

  • Refactor Registration Service, to send email on email taken
  • Define email template text with variables

Sub features:

  • [feat] Expose path /recover-account/email?identifier=${email/username} (TBD)
  • [feat] Create change username

@Brutus5000
Copy link
Member Author

Also hint: The email source code is here https://github.com/FAForever/faf-user-service/tree/master/src/main/mjml

@Ivan-Shaml
Copy link

Ivan-Shaml commented Jan 18, 2025

email template current state:

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants