The quiet email change
Someone used a customer's unlocked laptop for two minutes, changed the account's email to their own, then reset the password. The customer is locked out of their own account.
This answers: Should changing email need confirmation? No coding needed. 3 quick decisions.
- Who is signed in
- Who may see what
Checking your access…
Should changing email need confirmation?
Yes. The email receives reset links and login codes, so changing it is as sensitive as changing the password. Ask for the current password, confirm the new address with a link, and notify the old address with a way to undo. In Auth, keep 'Secure email change' on so both addresses must confirm.
Breaks at Auth service: Email changed with no confirmation
Why AI tools write this bug
AI-built profile pages often save the email field straight to the database like any other field, bypassing the auth provider's confirmation flow.
How to fix it
- Change emails only through your auth provider's flow.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Why notify the old address?
- If the change wasn't the owner, that email is how they find out in time to undo it.