Validate email when users create new account

[megoth]

The email field in user creation form is optional, but we should validate it if a value is given.

[Ryuno-Ki]

Validating against what? Whether it is a valid email? Whether the email is already in use? (hint: possible information leakage) Whether the email is associated with a known spammer?

[megoth]

I was only thinking that it should be a valid email.

[TallTed]

If this must be done by any means other than simply sending a "confirm your address" message, don't reinvent the wheel. Use the relevant snippet from the well tested Email Address Regular Expression That 99.99% Works.

[Ryuno-Ki]

Um, depending on how strict you want to be that regex could be huge ;-)

[megoth]

I was hoping to reuse the isEmail method in https://www.npmjs.com/package/validator.

[dmitrizagidulin]

I would go even farther and point to: https://davidcel.is/posts/stop-validating-email-addresses-with-regex/
(Which says, don't do it, or if you must, just use /@/ as the regular expression)

[dmitrizagidulin]

Btw, as far as that validator npm package, check out the options docstring for that isEmail() call. Doesn't that seem like the benefit-to-complexity ration is a bit low?

[megoth]

If this must be done by any means other than simply sending a "confirm your address" message, don't reinvent the wheel. Use the relevant snippet from the well tested Email Address Regular Expression That 99.99% Works.

We already have a confirmation email, so we could drop this issue because of that.

I was thinking of this merely as a helpful addition for those inserting an invalid email address.

[TallTed]

@Ryuno-Ki -- Note that your cited regex page is based on RFC 822, which was obsoleted by RFC 2822, and in turn by RFC 5322, on which my cited regex page is based.

@dmitrizagidulin -- Indeed. Hence my simply send a "confirm your address" message. On the other hand, as David Celis also recommends, Kicksend’s mail checker looks potentially helpful.

[Ryuno-Ki]

@TallTed Thanks for the update. I've bookmarked your link :-)

[megoth]

Btw, as far as that validator npm package, check out the options docstring for that isEmail() call. Doesn't that seem like the benefit-to-complexity ration is a bit low?

I've made use of validator.isEmail in #824, and didn't see the need for setting any options. But then again, I'm not good at validation of emails, so might be completely off?

[megoth]

@dmitrizagidulin -- Indeed. Hence my simply send a "confirm your address" message. On the other hand, as David Celis also recommends, Kicksend’s mail checker looks potentially helpful.

mailcheck.js looks very interesting to use on the front-end part of this (I was only thinking of backend initially).