{"action":"created","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3640","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3640/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3640/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3640/events","html_url":"https://github.com/plataformatec/devise/issues/3640","id":88857125,"number":3640,"title":"Confirmable's security model leads to a poor user experience","user":{"login":"vincentwoo","id":613320,"avatar_url":"https://avatars.githubusercontent.com/u/613320?v=3","gravatar_id":"","url":"https://api.github.com/users/vincentwoo","html_url":"https://github.com/vincentwoo","followers_url":"https://api.github.com/users/vincentwoo/followers","following_url":"https://api.github.com/users/vincentwoo/following{/other_user}","gists_url":"https://api.github.com/users/vincentwoo/gists{/gist_id}","starred_url":"https://api.github.com/users/vincentwoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vincentwoo/subscriptions","organizations_url":"https://api.github.com/users/vincentwoo/orgs","repos_url":"https://api.github.com/users/vincentwoo/repos","events_url":"https://api.github.com/users/vincentwoo/events{/privacy}","received_events_url":"https://api.github.com/users/vincentwoo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-06-16T22:31:59Z","updated_at":"2015-06-23T10:44:24Z","closed_at":null,"body":"I'm not sure if this is by design, but the following happens to me every day:\r\n\r\n1. A user registers for my website.\r\n2. They are directed to a specially crafted page I added to help deal with this very problem that tells them to *sit tight the email to confirm is coming ASAP*.\r\n3. User gets antsy, and requests a second confirmation email anyway.\r\n4. The first email arrives, but its link no longer works because requesting the second confirmation email resets the token.\r\n5. User gets upset and emails me. I confirm their account for them.\r\n\r\nI poked into the devise code to do something like \"reuse the last token if it was generated in the last minute or five\", but that's not feasible because Confirmable discards the original token, and only stores its digest.\r\n\r\nIs there any interest in... not... doing that? The tokens are randomly generated anyway, so I'm not sure what value there is in obfuscating the original token in the database.\r\n\r\nThis default behavior also makes it possible for me to indefinitely lock a new user out of their account by just requesting a new confirmation email for them every X seconds."},"comment":{"url":"https://api.github.com/repos/plataformatec/devise/issues/comments/114441516","html_url":"https://github.com/plataformatec/devise/issues/3640#issuecomment-114441516","issue_url":"https://api.github.com/repos/plataformatec/devise/issues/3640","id":114441516,"user":{"login":"josevalim","id":9582,"avatar_url":"https://avatars.githubusercontent.com/u/9582?v=3","gravatar_id":"","url":"https://api.github.com/users/josevalim","html_url":"https://github.com/josevalim","followers_url":"https://api.github.com/users/josevalim/followers","following_url":"https://api.github.com/users/josevalim/following{/other_user}","gists_url":"https://api.github.com/users/josevalim/gists{/gist_id}","starred_url":"https://api.github.com/users/josevalim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josevalim/subscriptions","organizations_url":"https://api.github.com/users/josevalim/orgs","repos_url":"https://api.github.com/users/josevalim/repos","events_url":"https://api.github.com/users/josevalim/events{/privacy}","received_events_url":"https://api.github.com/users/josevalim/received_events","type":"User","site_admin":false},"created_at":"2015-06-23T10:44:24Z","updated_at":"2015-06-23T10:44:24Z","body":"@carlosantoniodasilva the gain is that we can resend the token without generating a new one and without causing confusion to the user in case they ask the confirmation to be resent ."}}