Implementing Lazy Registration

Question

I'm interested in setting up Lazy Registration on my website.

Ideally, I'd like people to be able to fill out a record that might include their name, email, address, etc. and then record it to a user record later.

The problem is, sometimes the person filling out that form will already have a record on the site. At that point, if they enter a new address, this will overwrite the old one if there's already a record with that e-mail address (I don't want to create duplicate records for the same e-mail).

Since this is an open website, I have to ensure if someone is changing an existing record, that somehow they have to verify they are who they say they are before the record can be changed.

Right now I'm not sure what the best option is for confirming that.

Is it better to:

• Avoid lazy registration altogether if this is a concern, and force users to log in if the form they are entering has the potential to change an existing record
• Embed a login into the form -- so if they enter an e-mail for an existing record, it displays a login form that they have to fill out before the data is confirmed
• Pop up an Ajax-based login form while they are filling out the form, if they enter details (email, etc) that match an existing record in the database

Answer 1

Don't re-invent the wheel. The optimal solutions based on the requirements and needs you have presented in this thread is for you to use OpenID.

Answer 2

The lazy registration records should be separate from the "real registration" records. That would eliminate the need to "login". This also eliminates the need for any sort of validation of forcing them to log in. The temporary information is tied locally to some sort of locally persisted ID (Cookie or similar).

Someone visits your site, you want to lazy register them, so a form is popped and thier name and email is collected. At that point a cookie (ID) of some sort is stored locally so when they return you know who they are. So, the name and email is associated to that cookie (ID). At this point they have a temporary record that data can be recorded against and the user is not logged in.

At some point they will either register, the cookie (ID) will expire, or stop using the site. When they register, the temporary information is transferred to a real registration record and any data collected is pointed to the real record. The temporary record is removed. If they never register, you can still keep the temporary record and associated data.

What if they change thier name, no problem, the lazy record can be updated. What if they move around to machine or a different device, well they will have different lazy registration records. Can't help that because we really don't know who they are, they are "potential" users of the system and if they move around to 3 devices, those are three potential users because they haven't registered yet.

Once they register, they will be able to log in and change thier "real registration" record. Validation can be applied (user name unique or any other type of registation business log) and the user can update thier record. The lazy record will no longer be in existence.