如何在创建用户之前验证电子邮件？

Question

SITUATION:

I am trying to send a verification email to a user who just registered.

His account is not created unless he verifies his email address.

---

MY CODE:

 var userAuth = firebase.auth().currentUser;

        userAuth.sendEmailVerification().then(function() {

            req.flash('success_msg', 'Please verify your email address. You have 60 seconds');

            setTimeout(function(){ 

                if(userAuth.emailVerified) {
                    firebase.auth().createUserWithEmailAndPassword(email, password).then(userData => { 

                        var user = {
                            email: email,
                            username: username,
                        }

                        firebase.database().ref('users/'+userData.uid.toString()).set(user);

                        req.flash('success_msg', 'You have registered and logged in.');
                        res.redirect('...');

                    }).catch(error => {
                        var errorCode = error.code;
                        var errorMessage = error.message;
                        req.flash('error_msg', 'Registration Failed. ' + error.message);
                        res.redirect('/users/register');
                        console.log("Error creating user: ", error);
                    });  
                } else {
                    req.flash('error_msg', 'Registration Failed.');
                    res.redirect('/users/register');
                }

            }, 60000); 

        }, function(error) {
            console.log(error);
        });   

---

PROBLEM:

userAuth is of course null since the user hasn't been created yet. This means my code crashes.

---

QUESTION:

How can I achieve what I am looking for ?

Or is there a better way ?

---

REFERENCE

https://firebase.google.com/docs/auth/web/manage-users

Answer 1

Putting my collection of comments into an answer since it seems to have answered your question for you.

In order to be able to process the confirmation request when it comes in, you have to store something related to the pending user. You either create a user object and put it in a "pending" state that your code won't let be used for anything other than a confirmation or you create a separate type of object (a pending confirmation object) and that's all that exists until the confirmation happens. You do not want your existing request handler to "wait" until the confirmation happens.

Your current scheme allows attackers to load up your server with requests just waiting for something to happen which will probably either exhaust your memory or sockets. It's actually much better to have a tiny object stored in the database that you can clean out every few hours or so if they aren't confirmed. And, it's likely that some well intentioned users can't even do the confirmation in 60 seconds like you have coded so you'll just frustrate some of the legit users.

You HAVE to store something. When a confirmation link comes in, you have to have something to compare it to that you've previously stored. Otherwise, people could just make up confirmation links on their own and you'd happily process them. Storing something you created at the time of the original request is how you authenticate the confirmation link when that request arrives at your server and it's how you associate it with the right user object. I don't understand what the objection is to storing a small (probably under 100 bytes) account pending object in your database?