|
What if someone tries to register with an email that's not theirs. When they register, they get emailed a verification code to complete registration. If that's not their email, they don't get it, so they don't confirm. How long should I keep this account in the db? I'm thinking 2 hours then delete the account. First is 2 hours enough? Second, is there any reason I should not delete the record with all its info (username,password, etc)? |
|||
|
|
|
I would wait 24hours. If the user doesn't get the email straight away, they might walk away from their computer. I think 24 hours is a reasonable time to expect them to verify. I'm pretty sure I've registered for stuff then not confirmed straight away. I would say yes you should delete everything. Why keep it? In the UK, I think you'd be obliged to if any of the data is personal (name, date of birth, email address, etc)... you should check data protection laws in your country. |
|||||||||||
|
|
You need to work in days, not hours for this. Case in point: I registered with a site from work a few months ago. They sent a confirmation email, but the office Exchange server was down, so my emails weren't getting through. It was a Friday afternoon, so in the end I only got the confirmation email on the Monday morning. It could have been longer if there had been a public holiday on the monday, or if I'd been planning any time off work the following week (although I guess just possibly I wouldn't have done the signup on Friday afternoon if it was my last day in the office before a break!) |
|||
|
|
|
2 hours is not nearly long enough - some mail servers can hold mail for up to 24 hours before delivering it. I would say at least 24, possibly up to 48 hours before deleting the account. edit: And for the second question (sorry, didn't see it) it may be worth holding onto the email address, just in case you get repeat offenders who like to spam other people with these verification emails. If they register-and-don't-verify x number of times, perhaps blacklist them. |
|||||||||||||
|
|
It can take quite a while for an email to be delivered - even longer than 24 hours if there are server issues along the way. You user might simply do something else for a few hours and come back to complete registration later. I would keep an account for at least 7 days and then consider removing unverified accounts. If my account expired before I had a chance to confirm it, I would certainly think twice about completing a registration form again. |
|||
|
|
|
You may create no account at all: |
|||
|
|
|
I would assume, that there will be a significant amount of users that do not complete their registration within 2 hours. You also want to take into account that there are mail servers that do greylisting as part of their spam filtering, which means they reject mail from senders they don't know and accept it when it gets sent a second time. How long that process takes depends on how long your own mail server waits until he sends an email a second time. Further there are probably people that don't look into their mail accounts that often, signing up and trying to verify a day later or so. I would hold the unverified accounts for a week, then it should be pretty save to drop them. |
|||
|
|
