How do i handle multiple signups with the same email, while email confirmation is still pending?
Here are my tables
user uid - bigint primary key uname - varchar 255 unique uemail - varchar 255 unique upass - varchar 255 ustatus - int default 0
confirm cid - bigint primary key uid - bigint utokenhash - text
when a user registers using an email, ustatus is set to 0, to indicate that the email is pending confirmation. A token is sent to the user's email via a link to confirm email
A hash of the token is stored in the
confirm table with
uid to indicate the user. When the user clicks on the link, the token is taken, compared with the hash and the user email is verified. The entry in the
confirm table is deleted.
ustatus is changed to 1 to indicate that the user is valid.
How can i handle situations like the one mentioned below?
User A signs up with the email email@example.com and is awaiting email confirmation to verify his email. Meanwhile user B comes and attempts a signup with the same email firstname.lastname@example.org.
One solution that i found is to remove
uemail, when either one confirms the email, change
ustatus to 1 for that user and delete the other user. Make sure that email is unique from the application side (which is already being checked).
But i don't know if it is a good practice to let application side be solely responsible for this. If something goes wrong on the application side, someone can send multiple email confirmation to a single already registered user.
- Recaptcha is added to the signup forms.
- Username is also unique
Is there any other way to handle this? Is my proposed solution "okay"?