How do I require asp.net forms authentication to send a validation email when registering a new account?

Question

I have just set up a new ASP.NET MVC website and I would like to change it to force the user to authenticate their email address by clicking a validation link in an email. I googled the answer with as many search terms as I could think of, but I guess I never hit the correct one.

I started playing with the membership objects to see what I could come up and I did see you can toggle IsApproved, and so I set the default to false. I registered a new user after that and no email came through (as I had expected), but also it logged me in anyway for the current session. Thats beside the point however.

Is there a built in mechanism for sending out a validation email or is that something I need to implement?

Answer 1

There's nothing built-in to achieve this. You'll have to implement the email sending and validation process yourself, unfortunately.

You're on the right lines, though. Once a user is registered on your site, you'll have to set their IsApproved property to false, create a random "activation code" and store this (usually in a manually added field on the aspnet_Membership table or as part of the ASP.NET Profile if you're using Membership Profiles), send off the email with a URL that contains the user's "activation code". Once the user receives this email and visits the URL, you grab their "activation code" from the URL, look up the account from the ASP.NET membership system and set their IsApproved property back to true.

For detailed information on how you can achieve this, take a look at:

Examining ASP.NET's Membership, Roles, and Profile - Part 11

This is Part 11 of a 16 part series on ASP.NET's Membership, Roles and Profile providers, and not only shows how they are used with the built-in functionality offered, but also shows how to implement some commonly seen functionality that isn't provided "out-of-the-box" with the ASP.NET systems. (Incidentally, the whole series is well worth reading!)

Although this article was written well before the advent of ASP.NET MVC, the basic mechanism for implementing a "verify-by-email" system is the same and is easily converted to be more ASP.NET MVC-friendly.