Creating hash/token from user email for email-verification

Question

Can anyone help me out with an answer to what to use for creating a security token (or hash) from a user input (email address). I'd like to make an email verification system for registration.

• user registers with an email address and password
• I would like to create a unique URL which I would send out to the user (hence the question)
• I store these (secure wise) in a temp table
• The user verifies himself via the URL sent out

My question is how this URL should look like. I think I should make it unique by encoding the email address into it, saving the url to the temp-table and when the user opens the link I would compare the two. If match, I would move the credentials to the real table.

Do you have any good resource about this topic. I have nodejs on the backend. Thanks

Answer 1

I think your method is also correct. I have done email verification using a similar method in Express (REST API) . I have used JSON web token (jwt-simple package) to encode email_id, user_id and expiry_date (which is used to check the validity of link that is sent on user's registered email address).

Then append this encoded data to link Example : http://your_backend_server_link/verifyEmail/1234567890afshgdf..

   router.post('/AddUser', function(req, res, next) {
    var user = new User();
    user.name = req.body.name;
    user.email = req.body.email;
    user.is_verified = false;

    user.save(function(err,user){
       if(err){
           console.log(err);
           res.json(err);
       } else{
           console.log("User data saved");

           var transport = mailer.createTransport({
               service : "Gmail",
               auth : {
                   user : config.central_email,
                   pass : config.central_email_password
               }
           });

//           tommorow's date
           var info = {};
           info.user = user;
           info.expiry = new Date(new Date().getTime() + 24 * 60 * 60 * 1000);
           var token = jwt.encode(info,config.secret);
           console.log("http://localhost:3000/verifyEmail/" + token);

           var mailOptions = {
               from : "TEST<[email protected]>",
               to : user.email,
               subject : "Welcome to TEST",
               text : 'Visit this http://localhost:3000/verifyEmail/'+token,
               html : '<a href="http://localhost:3000/verifyEmail/'+token+'"><H2>Click on this</H2></a>'
           }
           transport.sendMail(mailOptions,function(email_err,email_data){
               if(email_err){
                   console.log(email_err);
                   res.json(email_err);
               }else{
                   console.log("Email is Sent");
                   res.json({result : 1});
               }
           });

       }
    });
});

When user clicks on this link, get token from URL and decode it. Check for expiry_date by comparing it with the current date of server for the validity of link

router.get('/verifyEmail/:token',function(req,res){
    var token = req.params.token;
    var data = jwt.decode(token,config.secret);
    console.log(new Date(data.expiry));
    console.log(new Date());
    if(new Date(data.expiry) > new Date()){
        User.findOne({ _id : data.user._id, name : data.user.name })
            .exec(function(err,user){
            if(err){
                console.log(err);
                res.json(err);
            }else if(!user){
                console.log("User not found");
                res.json({error : "User not found"});
            }else{
                console.log("User found");
                user.is_verified = true;
                user.save(function(update_err,update_data){
                    if(update_err){
                        console.log(update_err);
                        res.json(update_err);
                    }else{
                        console.log("Email is verified of user "+update_data._id);
                        res.json({result : 1});
                    }
                });
            }
        });
    }else{
        console.log("Link is expired");
        res.json({error : "Link is expired"});
    }
});