Security: Email camping

[MGatner]

Because email addresses must be unique in the database, accounts can be denied intentionally or accidentally by "camping" a new account with the email address, verified or not. Unverified emails should either go in a different field or the Model requirements should be loosened to allow multiple instances of the same email.

[SpiralBrad]

How would an account be 'camped' if it's verified?

[MGatner]

@SpiralBrad it need not be verified to use up that one "unique" slot in the database. If I create a new account as [email protected] but obviously don't own that address then you will never be able to use it.

[SpiralBrad]

Sure, but you said “verified or not”.

…but if it’s verified, it wouldn’t be camped. …cuz it’s verified.

[MGatner]

Understood! Yes I see now how that phrasing was confusing.