I am planning to start a new asp.net core MVC web application. One of the features we are having is that anonymous users can register inside our web application by entering their email addresses. then our system will send them a confirmation email, to activate their accounts.
Now by default the system will show error message, in-case a user try to register using existing email address, even if the existing email address was not confirmed. now this will pose a major problem in our system, is that hackers can use others' email addressees, and prevent them from registering inside our web application. Our web application is a CRM-like for real estate companies, and hackers can try to add as many email addresses has they want, they can get these email addresses from the companies' web sites such as
admin@.. , etc.
So is there any problem if I do the following modifications:-
- If the user did not confirm the email address in 1 hour, then the system will automatically remove his email address?
- When I want to check if an email address is unique to check only the approved email addresses.