Preventing plus-addressing abuse
3 of 3 posts published
Plus-addressing (or sub-addressing) lets someone turn a single mailbox into an unlimited supply of email addresses - mary+1@gmail.com and mary+2@gmail.com both land in mary@gmail.com. This technique is often used by people who want to abuse free trials and sign up for multiple accounts with effectively a single email address.
This series walks through various approaches to this problem, from outright rejecting them, to more advanced approaches that allow plus-addressing while still ensuring the underlying email address is only used once.
- 1.
Disallow application signups with emails containing a plus
Learn how to prevent multiple signups to your application from people using plus-addressing (aka sub-addressing)
- 2.
Prevent plus-addressing abuse with normalized emails
Use the NormalizedEmail and NormalizedUserName properties of ASP.NET Core Identity to stop multiple signups from plus-addressed emails
- 3.
Prevent plus-addressing abuse with a primary email
Store the primary email in a shadow property and add a custom user validator to enforce uniqueness without hurting the user experience