Designing an new user confirmation (verify via email)

Question

I am developing an ASP.Net application that will need to verify that the user is legit and not a spam. Once the new user enters their first name, last name, email address, my application will send an email to verify the user's authenticity. The email would conatin a link that would confirm the users account.

I am looking help on what the logic is behind the email link. Once the user clicks the link, what happens?

I have had a website that has used Captcha, and not had much luck stopping spam (I know you can't stop 100% spam) similar to this http://stackoverflow.com/questions/3247478/stopping-spammers-from-creating-accounts-recaptcha-not-doing-the-trick

Answer 1

As Rook has pointed out below, the simplest way is to use Captcha.

If you need to verify the email as well though, see below.

---

You could generate an approval GUID and pass it to the email URL which would mark the User as Active.

For example, add a column called ApprovalID to the users table and generate a new GUID when the user registers, i.e.

You should mark the user as inactive at this stage.

Example Guid 3F2504E0-4F89-11D3-9A0C-0305E82C3301 

Then pass the User Id and GUID in the email body

<a href="http://www.mysite.com/verify.aspx?UserId=TheUserId&amp;ApprovalId=3F2504E0-4F89-11D3-9A0C-0305E82C3301"&gt;Verify your account</a>

Then a simple page verify.aspx

Code Behind

string UserId = Request[UserId].ToString(); // You can parse these as Guids
string ApprovalId = Request[ApprovalId].ToString();

TODO:
// Get user from database
// Match QueryString ApprovalId to Column ApprovalId
// Ask user to Log In
// Set user as active

Answer 2

Sending a confirmation link doesn't do anything to stop spam. Emailing someone a link with a Cryptographic Nonce just insures that they can receive email, bots can also receive email.

The best way stop spam is by using capthca, and I recocmend using reCapthca. You should prompt the user with a capthca when a user signs up for your service.