Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

Post reply on HN
Print view View original

41–50 of 405 posts

Re: The Correct Way to Validate Email Addresses

#41

Post by detaro »

gizmodo59 wrote: post #21
JacobJans wrote: post #19

I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.

Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.

I don't think having users always retype the address is what the parent post suggested, but to look for common errors and if one is found prompt for verification.

Re: The Correct Way to Validate Email Addresses

#42

Post by jeremy_wiebe »

gizmodo59 wrote: post #21
JacobJans wrote: post #19

I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.

Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.

And as soon as you invoke copy-paste the second confirmation field loses all value anyways.

Re: The Correct Way to Validate Email Addresses

#43

Post by Programmatic »

wtbob wrote: post #37
tedmiston wrote: post #20

Hmm, sorry but I don't buy that the "correct way to validate" is not to validate the input. Email addresses aren't a special enough case to be handled differently than any other user input, which we always validate to both sanitize and show client-side errors, if nothing else. Sure, the complete regex is complex, but it is defined and is hardly unconquerable. Look at Django's `EmailValidator` implementation for examp…

> Sure, the complete regex is complex, but it is defined and is hardly unconquerable. If it is a regular expression, then it is not able to match all valid email addresses, because the grammar of email addresses is context-free, and regular expressions can only match regular grammars. It doesn't matter if it is defined or not: if it's a true regular expression, then it simply cannot validate email addresses. (it may,…

You are correct:

  >>> from django.core.validators import EmailValidator
  >>> EmailValidator()(""""()[]:,;@\\\"!#$%&'-/=?^_`{}| ~.a"(is)@(valid)example.org(honest)""")
  Traceback (most recent call last):
    File "", line 1, in 
    File "/usr/local/lib/python2.7/dist-packages/django/core/validators.py", line 203, in __call__
      raise ValidationError(self.message, code=self.code)
  django.core.exceptions.ValidationError

Re: The Correct Way to Validate Email Addresses

#44

Post by gregmac »

gizmodo59 wrote: post #21
JacobJans wrote: post #19

I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.

Asking to retype though being a simple solution IMHO is asking for a lot. Consider a user who uses mobile phone, even copy paste is annoying. Validating if the mail box exists and that it does not belong to a provider like mailinator and then sending a confirmation link to them works. While its not perfect, it does address lot of other concerns without sacrificing user experience.

Why do you care if the address is for mailinator?

Re: The Correct Way to Validate Email Addresses

#45

Post by honkhonkpants »

tedmiston wrote: post #20

Hmm, sorry but I don't buy that the "correct way to validate" is not to validate the input. Email addresses aren't a special enough case to be handled differently than any other user input, which we always validate to both sanitize and show client-side errors, if nothing else. Sure, the complete regex is complex, but it is defined and is hardly unconquerable. Look at Django's `EmailValidator` implementation for examp…

Regarding that testdata, what is the reason for rejecting bare IP literals on the right hand side? It seems pedantic to require the square braces.

Re: The Correct Way to Validate Email Addresses

#46

Post by gregmac »

pbreit wrote: post #26
amk_ wrote: post #2

TL;DR the odds that the user entered an incorrect-but-valid address are way higher than that they entered one which will not actually be able to receive mail. Send a validation email.

Address validation by sending an email should only be used if it is required for some reason to verify the user owns the email account. Otherwise, it's not a great UX.

I honestly can't think of a reason you'd ask a user for their email but not need to validate it.

For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated.

If you're looking for a username as login identity and nothing more (and you don't have password reset functionality), then ask for a 'username', not email addresses.

Re: The Correct Way to Validate Email Addresses

#47

Post by zAy0LfpBZLC8mAC »

brightball wrote: post #12

This is the best comprehensive way that I've found: https://github.com/kdisneur/email_checker It breaks down into 3 parts that can be used either independently or as a whole: format, MX and SMTP.

That's just broken, the DNS lookups are wrong, the SMTP implementation is defective, I didn't look any further.

Re: The Correct Way to Validate Email Addresses

#48

Post by usaphp »

ryandrake wrote: post #35
Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

Even worse is rejecting my password because it has a + in it! Why do you as a business care what my random password generator spit out?? Scarier still is when it's a server-side response that rejects my password for its contents...

Or when a password that is generated by my password manager is rejected with a message "Password should be 12 characters maximum". Why???

Re: The Correct Way to Validate Email Addresses

#49

Post by brightball »

kej wrote: post #22
brightball wrote: post #12

This is the best comprehensive way that I've found: https://github.com/kdisneur/email_checker It breaks down into 3 parts that can be used either independently or as a whole: format, MX and SMTP.

That one fails " "@example.com and test@example, both of which are legal. Also, since it relies on looking up MX records and then making an SMTP connection to check if the user exists, why not just send the confirmation email? You've already done all of the expensive stuff at that point.

You haven't had to bother the user yet. Also, shouldn't example.com fail?

Re: The Correct Way to Validate Email Addresses

#50

Post by dbarlett »

JacobJans wrote: post #19

I do a lot of optin email. Here are some examples of bounced emails that people use to sign up: * somename@gmail.co * anothername@yhoo.com * myemail@hotmial.com These are very common errors that occur nearly every day. A regex isn't going to help here. What does help, is a notification that asks people to verify what they typed –– if the email contains an obvious, common error, such as one listed above.

mailcheck [1] is great for this, especially when supplemented with your users' most popular email domains.

[1] https://github.com/mailcheck/mailcheck

Post reply on HN