Contents
How to restrict access until user has confirmed email link?
Based off of other site’s 2FA implementation (Mandrill for one) they have users enter their user\\pass, then additionally enter a passcode sent to their phone before they are authorized to enter the site. This is different from just verifying the email account before the user\\pass is allowed to be used.
How do I change my admin email address?
In the admin center, go to the Users > Active users page. Select the user. In the flyout pane, next to Username / Email, select Edit. In the first box, type the first part of the new email address.
How to redirect URL based on confirmation link?
For the second step, the suggested solution uses a custom API endpoint with a Lambda to call the Cognito API (to confirm the user) and returns an HTTP 302 to redirect the user based on the redirect information encoded in the confirmation link. I wonder why no one handles confirmation and redirection on the client-side?
What happens when you verify your website address?
When you verify your website address, a user in your account proves that they have authorized ownership of the website. Verification doesn’t give Google any elevated access to your website. Keep in mind that only the user who verifies a website can later claim it.
What happens when you restrict an email address?
When you restrict addresses or domains: Receiving—Users can only receive messages from authorized addresses or domains. Sending—Users who send messages to an unauthorized domain get a bounce message explaining why their email was not sent.
How to prevent users without confirmed email from logging in?
I would let the admin create the user without any password. The email with link should go to the user. The user then is directed to SetPassword page to set new password. This way no one can access the user account unless he confirms and sets the password.
Is it safe to block a user from accessing an e-mail?
This is safe since the user already signed in. We are just blocking further access until the e-mail is verified. For each time a user tries to login without having validated the email, a new email (with the same link) is sent. This could be limited by keeping track of the number of sent emails.