Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Correct Way to Validate Email Addresses

hackernoon.com

Post reply on HN
Print view View original

71–80 of 405 posts

Re: The Correct Way to Validate Email Addresses

#71

Post by zAy0LfpBZLC8mAC »

jwecker wrote: post #59
zAy0LfpBZLC8mAC wrote: post #51

Earlier quoted context omitted.

> I always assumed it was more a sanitization issue for security's sake. Sanitization is at best idiotic, at worst creates security problems. There is no such thing as "bad characters", there only is broken code that incorrectly encodes stuff. If you ever find yourself modifying user input "for security reasons" (or really, for any reason at all), you are doing it wrong. The only sane thing to do is to make sure that…

An email address isn't a document though, it's a routing command. I don't mean sanitization in the sense of inserting backslashes. I mean sanitization in the sense of "we don't allow people to set their email address to a mailbox on localhost at our mail server."

1. Sanitization generally means changing information. As in, "removing bad characters", that kind of stuff. That's different from validation, which should result in rejection of bad input, and which can be perfectly fine. However, more often than not, validation is implemented badly and rejects perfectly fine input, which is why validation shouldn't be employed more than necessary either.

2. Rejecting @localhost addresses doesn't really make a whole lot of sense. People could just enter the public IP address or hostname of the server, or add a DNS A record under their own domain that points to 127.0.0.1, or an MX record that points to localhost, or any number of other weird stuff that you could not possibly validate anyway (if only because it could be changed at any point lateron). Just configure your mail server properly and then send the damn email, and if it does get sent to root@localhost, and possibly forwarded to the admin--so what? People obviously could just sign up using your admin's email address anyway, and that not only at your site, but at millions of sites out there, you won't be able to stop them. There is nothing particularly dangerous about receiving unsolicited signup emails or about sending emails to yourself.

Re: The Correct Way to Validate Email Addresses

#72

Post by jwecker »

lstamour wrote: post #70
jwecker wrote: post #59

Earlier quoted context omitted.

An email address isn't a document though, it's a routing command. I don't mean sanitization in the sense of inserting backslashes. I mean sanitization in the sense of "we don't allow people to set their email address to a mailbox on localhost at our mail server."

Then reject email addressed to localhost. It shouldn't matter how the email got there. I'd suggest that especially given DNS trickery involving setting up a low TTL then redirecting to 127.0.0.1, you're probably not preventing this from happening or you'd have to invalidate any unrecognised domain. Better to solve that problem at a different layer -- validate the email by sending a validation link if you must...

True, but that's my point- it's a backend issue, not a front-end "help the user" issue.

Re: The Correct Way to Validate Email Addresses

#73

Post by zAy0LfpBZLC8mAC »

tedmiston wrote: post #33
acdha wrote: post #25

Earlier quoted context omitted.

You can use a regex as a simple pre-check but you absolutely have to do more than that if you expect high-quality results. Back in the 90s, we ran the customer rewards program mailing list for a mainstream business you've heard of. A [gnarly] regex took care of the gross failures but we still had double-digit percentage of invalid addresses and many spam reports because people mistyped their username, used their old…

Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).

1. There are no "obviously invalid email address[es]".

2. Getting billed for sending emails? WTF?

Re: The Correct Way to Validate Email Addresses

#74

Post by vacri »

gregmac wrote: post #46
pbreit wrote: post #26

Earlier quoted context omitted.

Address validation by sending an email should only be used if it is required for some reason to verify the user owns the email account. Otherwise, it's not a great UX.

I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated. If you're looking for a username as login identity and nothing more (and you don't have pas…

email addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense

Re: The Correct Way to Validate Email Addresses

#75

Post by zAy0LfpBZLC8mAC »

vacri wrote: post #74
gregmac wrote: post #46

Earlier quoted context omitted.

I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated. If you're looking for a username as login identity and nothing more (and you don't have pas…

email addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense

> email addresses for usernames have the advantage of already being unique

Not true. There are people who share an email address.

Re: The Correct Way to Validate Email Addresses

#76

Post by acdha »

tedmiston wrote: post #33
acdha wrote: post #25

Earlier quoted context omitted.

You can use a regex as a simple pre-check but you absolutely have to do more than that if you expect high-quality results. Back in the 90s, we ran the customer rewards program mailing list for a mainstream business you've heard of. A [gnarly] regex took care of the gross failures but we still had double-digit percentage of invalid addresses and many spam reports because people mistyped their username, used their old…

Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).

Obviously invalid can be a tough measure, though - many people who used domains other than .com/.net/.org have reported sites incorrectly denying their address. If I was still doing this, I'd start by doing some loose validation on the address and checking whether the domain resolved in DNS before returning a form validation error.

The other key step is having some contact form which doesn't require the same test so people can report bugs if you get the logic wrong.

Re: The Correct Way to Validate Email Addresses

#77

Post by freestockoption »

Benjamin_Dobell wrote: post #30

The number of websites that try reject my email address with a + in it, ugh! Surprisingly, the validation is often done 100% client-side anyway, and simply modifying the incorrect regex lets my email address through... If I wrecked havoc on your back-end, then it's your fault for sucking ;)

I had trouble signing up for JetBlue because I had a . in my email address!!!

Re: The Correct Way to Validate Email Addresses

#78

Post by AgentME »

sly010 wrote: post #28

If someone's valid email address [*\"32f2@13.31.43.11 they are up to no good and I don't want them as my customer. Also, according to the standard email addresses supposed to be case sensitive, since the username part refers to a unix user and unix is case sensitive. I work with a lot of email address lists originally collected on paper and of course noone knows that. So as bad as it sounds, part of my sanitation pro…

Is it specifically the [, *, \, " symbols on the left that you're calling out, the presence of numbers on the right side, the presence of multiple periods on the right side, the lack of letters on the right side, or just the lack of non-numerics on the right side? I don't think most of those rules are needed technically; I wouldn't be surprised if at least one of those rules matches someone reading this comment thread. Any one of those individually seems like a strange minor reason to pre-emptively ban a customer if it doesn't necesarrily cause technical problems.

If it's only people hitting multiple of those conditions, then maybe you could use a scoring function that only rejects users that meet multiple conditions? If the reason for the validation is a character judgment instead of a technical limit, then you could add more conditions too. People with email addresses that contain accented characters probably don't even speak the same language as you, so you could save yourself some headaches by marking those invalid. If you don't like leetspeak, then I think banning the letter "x" could be a good move too on average. "+" is used by a lot of people who want to trace whoever you might be selling your email lists to, so you could ban them before they blow the whistle on anything. Email addresses containing references to political candidates probably aren't owned by savory characters, so you could mark those as invalid too... Now that I think about it, since it's not for technical reasons, then none of this is really specific to emails. You could run passwords and other user content through this validation too.

If the restrictions aren't for technical reasons, then they're just arbitrary tools for blocking users.

Sorry for ranting a bit. I'm just tired of how often I get mystery validation errors from services because something stupid like that it turned out they thought that english works that happen to be sql keywords like "insert" shouldn't be allowed in the subject field, or my friend with an apostrophe in his name repeatedly being turned away from software telling him his name is invalid, and the idea that these rules could be in place just to cause people like us this annoyance ticked me off.

Re: The Correct Way to Validate Email Addresses

#80

Post by gregmac »

vacri wrote: post #74
gregmac wrote: post #46

Earlier quoted context omitted.

I honestly can't think of a reason you'd ask a user for their email but not need to validate it. For being able to do password resets later, permission to add to mailing list, avoiding sending private info to the wrong user, avoiding allowing someone to masquerading or impersonate someone they're not.. All should be validated. If you're looking for a username as login identity and nothing more (and you don't have pas…

email addresses for usernames have the advantage of already being unique. None of this "gregmac already taken, try gregmac23, gregmc_595, or verbingnounXX instead?" nonsense

I agree, but in that case, you should be validating the e-mail address (which was my original point).

Failure to do so means:

- The user who actually owns that e-mail can't login

- The user who signs up can potentially impersonate the real user (depending on what your app does)

- The user who signs up can't reset their password

- The user who actually owns the e-mail can take ownership of the account (by resetting password)

Post reply on HN