Download the PHP package symfonycasts/verify-email-bundle without Composer

VerifyEmailBundle: Love Confirming Emails

Don't know if your users have a valid email address? The VerifyEmailBundle can help!

VerifyEmailBundle generates - and validates - a secure, signed URL that can be emailed to users to confirm their email address. It does this without needing any storage, so you can use your existing entities with minor modifications. This bundle provides:

• A generator to create a signed URL that should be emailed to the user.
• A signed URL validator.
• Peace of mind knowing that this is done without leaking the user's email address into your server logs (avoiding PII problems).

Installation

Using Composer, of course!

Usage

We strongly suggest using Symfony MakerBundle's make:registration-form command to get a feel for how the bundle should be used. It's super simple! Answer a couple of questions, and you'll have a fully functional, secure registration system with email verification.

Setting Things Up Manually

If you want to set things up manually, you can! But do so carefully: email verification is a sensitive, security process. We'll guide you through the important stuff. Using make:registration-form is still the easiest and simplest way.

The example below demonstrates the basic steps to generate a signed URL that is to be emailed to a user after they have registered. The URL is then validated once the user "clicks" the link in their email.

This uses an EmailVerifier class that you should also add to your app:

Anonymous Validation

It is also possible to allow users to verify their email address without having to be authenticated. A use case for this would be if a user registers on their laptop, but clicks the verification link on their phone. Normally, the user would be required to log in before their email was verified.

We can overcome this by passing a user identifier as a query parameter in the signed URL. The diff below demonstrates how this is done based on the previous examples:

Once the user has received their email and clicked on the link, the RegistrationController would then validate the signed URL in the following method:

Configuration

You can change the default configuration parameters for the bundle by creating a config/packages/verify_email.yaml config file:

lifetime

Optional - Defaults to 3600 seconds

This is the length of time a signed URL is valid for in seconds after it has been created.

Reserved Query Parameters

If you add any extra query parameters in the 5th argument of verifyEmailHelper::generateSignature(), such as we did for id above, take note that you cannot use the following query parameters, because they will be overwritten by this bundle:

• token
• expires
• signature

Support

Feel free to open an issue for questions, problems, or suggestions with our bundle. Issues pertaining to Symfony's MakerBundle, specifically make:registration-form, should be addressed in the Symfony Maker repository.

Security Policy

If you discover a security vulnerability, please do not open a public issue or pull request. Instead, please review this repository's Security Policy for instructions on how to report it responsibly.