May I safely treat email addresses lower case?

Question

In theory emails are case sensitive. But using emails as system login I want them to be all lower case (i.e. [email protected] and [email protected] cannot be different users).

Can this be a problem for some users who use case sensitivity in their email address? Does somebody use it out there?

Edit: Because there are many "preserve case on save, ignore on login" answers: This system would break if I really had two different users john@smith and John@smith, wouldn't it?

Example: john@smith and John@smith have the password 123. How do I know which one just authenticated?

Answer 1

Don't throw away data. Store the email address or username exactly as you received it, with the exception of trimming both ends of the string.

When sending email, use the case that was supplied by the user. Just because case-sensitivity is rare is no reason to not handle it - otherwise that user gets no mail, and can possibly not even register.

When authenticating a user, you can optionally do a compare on lower case (or upper case) strings, so that the case is disregarded.

So, by preserving the user input data you have suddenly given yourself options: whether to do case-sensitive compares on authentication, and whether to use case-sensitive email addresses when sending mail. Even if you don't choose to avail yourself of them now, the purpose of preserving data is to allow you (or some other developer) to have those choices down the road.

Answer 2

According to RFC 2821:

The local-part of a mailbox MUST BE treated as case sensitive. Therefore, SMTP implementations MUST take care to preserve the case of mailbox local-parts. Mailbox domains are not case sensitive. In particular, for some hosts the user "smith" is different from the user "Smith". However, exploiting the case sensitivity of mailbox local-parts impedes interoperability and is discouraged.

So, while you can treat emails addresses with case sensitivity, you are discouraged from doing so.