Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

Post reply on HN
Print view View original

91–100 of 405 posts

Re: The Correct Way to Validate Email Addresses

#91

Post by mschuster91 »

ryandrake wrote: post #35
Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

> Scarier still is when it's a server-side response that rejects my password for its contents...

A friend's project decided to disallow umlauts, combined characters like ´e (can't type the correct e with accent mark), the pipe symbol and a couple more in new passwords.

Not due to plaintext storage or so, but because of customer service issues - people were bugging support all the time because they were e.g. abroad and couldn't enter umlauts or on a Mac and couldn't find the pipe symbol (it isn't written on the keyboard!)... of course, a quick direction to the Zeichentabelle in Windows helped, but what for Mac users? At least it did take a huge load off the customer service guys.

I'm looking forward to the date when some clueless user will input a UTF8 emoji as a password, given that Android and iOS keyboards now include these on special keyboards...

Re: The Correct Way to Validate Email Addresses

#93

Post by nilved »

namenotrequired wrote: post #82
stouset wrote: post #39

Earlier quoted context omitted.

Also, asking to retype makes sense for a password where you can't visually verify that you typed what you expected. For an email address, it's pointless and frustrating. Send an email. If it bounces or doesn't get verified in a timely fashion, it was a mistake and delete the account.

And the user never discovers their mistake.

They'll discover they don't get a validation email.

Re: The Correct Way to Validate Email Addresses

#94

Post by Retra »

namenotrequired wrote: post #82
stouset wrote: post #39

Earlier quoted context omitted.

Also, asking to retype makes sense for a password where you can't visually verify that you typed what you expected. For an email address, it's pointless and frustrating. Send an email. If it bounces or doesn't get verified in a timely fashion, it was a mistake and delete the account.

And the user never discovers their mistake.

That's just what happens when you give bad contact information.

Re: The Correct Way to Validate Email Addresses

#95

Post by kazinator »

Sorry, I disagree.

There is absolutely is a correct way to lexically validate an e-mail address: namely, implement a parser for the syntax specified in whatever RFC is the up-to-date successor of RFC 822.

There is such a thing as incorrect e-mail address syntax: namely, non-RFC-conforming syntax, whatever that is.

You may reject that, and that's about it.

Please don't reject RFC-conforming e-mail addresses.

Re: The Correct Way to Validate Email Addresses

#96

Post by sbuttgereit »

usaphp wrote: post #48
ryandrake wrote: post #35

Earlier quoted context omitted.

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

Or when a password that is generated by my password manager is rejected with a message "Password should be 12 characters maximum". Why???

Ha! If only! Probably more than 50% of the sites I visit that have a maximum length that my password manager exceeds... give me an unrelated error message. Some times they tell me I haven't met the minimum length (100 chars, really?), sometimes they tell me that I've not met complexity requirements (I use upper/lower/numbers/special chars), etc.

It's as though the developer only ever thought of how people wouldn't meet their minimum requirements, wrapped it all in a case or switch and let the default be whatever they hadn't checked in previous conditions.... not thinking that anyone would exceed their requirements.

Very annoying and sloppy.

Re: The Correct Way to Validate Email Addresses

#97

Post by voidz »

blechschmidt wrote: post #53
Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Yes, the + is incredibly useful for tagging emails. When I register new web accounts, I always specify a new unique tag so that I can track down the source in case I receive spam. Furthermore, they help my mail server when filtering out junk mail.

These days I do this differently; I created a subdomain that forwards all email to my main account. hackernews@foo.example.com would forward to main@example.com, and I can just filter the prefixes. That way I can use the subdomain for my own unique addresses, without interfering or using up addresses on the parent domain.

Re: The Correct Way to Validate Email Addresses

#98

Post by mariusc23 »

rickycook wrote: post #38
ryandrake wrote: post #35

Earlier quoted context omitted.

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

scarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me

I've had that happen with Comcast. I think they fixed it but it was pretty annoying. The signup password input had no max length but the login form did.

Re: The Correct Way to Validate Email Addresses

#99

Post by [deleted] »

rickycook wrote: post #38
ryandrake wrote: post #35

Earlier quoted context omitted.

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

scarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me

[deleted]

Re: The Correct Way to Validate Email Addresses

#100

Post by [deleted] »

rickycook wrote: post #38
ryandrake wrote: post #35

Earlier quoted context omitted.

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

scarier still is when they let you set it but fail to let you log in (generally happens more with length). i don't know what you're doing, but i know it's not right and it scares the hell out of me

[deleted]
Post reply on HN