[BUG] Same email can be used more than once
Closed this issue · 7 comments
Describe the bug
Users can sign up with the same email associated with multiple accounts. This is currently blocked by simply checking if the user entered email exists in the database, but is case sensitive. Thus, user@example.com and User@example.com are treated as different users, even though they point to the same mailbox.
Expected Behavior
Only one of these emails should be allowed to register; the first one entered.
Current Behavior
Both emails are allowed to be used.
Possible Solution
All emails should be converted to lowercase whenever they are being accessed/compared/stored.
This includes:
- signing up
- logging in
- emails in the database
Steps to Reproduce
- Create a user with some email
- Create another user with the same email, but different capitalization
- Observe that both accounts can be created
Context (Environment)
Doesn't matter, this exists in every version and platform
To be merged into v3.3.0
Emails like a+b@gmail.com and a+c@gmail.com are also both accepted, even though both go to the same email.
@jdabtieu One ques do you want this validation to be added on email only or on username also?
The naive way to implement this seems to be to
- Reject any email with + character
- Warn users that their emails will be lowercased
- Lowercase emails before this
- Add tests for the above
- Lowercase all emails in DB in the migrate script