authentication/email

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Email canonicalization: store both original and canonical form

Applications must normalize email addresses consistently before storage and comparison. Store both the original input (for display and communication) and the canonical form (for comparison according to the defined policy). The canonical form is used for consistency across registration, login, password reset, account recovery, and account linking flows.

Email domain normalization to lowercase

Normalize the domain portion of email addresses to lowercase. Avoid provider-specific transformations such as Gmail dot removal unless the application fully controls this behavior.

Document email comparison policy explicitly

Define and document the comparison policy for email addresses explicitly, then apply it consistently across all identity-related flows: registration, login, password reset, account recovery, and account linking.

Email format validation: use libraries instead of regex

Use well-tested libraries for email format validation instead of writing custom regex patterns. Accept a broad range of valid formats and reject only clearly malformed input.

Unicode email normalization and punycode conversion

Normalize Unicode input in email addresses and convert internationalized domains to punycode for comparison. Be aware of homoglyph attacks where visually similar characters from different scripts can be confused. Be especially cautious with internationalized local-parts, as normalization and comparison behavior may differ across systems.

Email local-part case sensitivity handling

Preserve the original email address as entered by the user. Define an explicit comparison policy for the local part based on the identity architecture and interoperability requirements. Only fold or normalize the local part when the system fully owns that behavior and the decision will not create account-collision or mistaken-account risk. Note that the domain part is always case-insensitive.

Email ownership verification: single-use, time-limited tokens

Email ownership must be verified before enabling account use. Use cryptographically secure, random tokens that are single-use and time-limited. Do not activate accounts before verification is completed.

Email change requires re-authentication and dual confirmation

Changing an email address is equivalent to changing identity. Require re-authentication before the change. Notify the existing email address of the change. Require confirmation of the new email address. Consider requiring confirmation from both addresses for high-risk systems.

Forgot Password: password reset - send confirmation email without password

Send the user an email informing them that their password has been reset, but do not send the password in the email.

Give your agent this brain