FriendsOfSymfony/FOSUserBundle — Issue #408: Security improvements
Author: zhil
Created: 2011-11-16 10:37:51+00:00
State: open

What do you think about idea of adding new field signup_email (or primary_email) into entity? This field should never be changed.

It will add additional protection. In case if user's account will be compromised and somebody will change email and password, it would be hard to detect, who is actual owner.

Also it would be nice idea to send confirmation link to the old email when user change it to the new one. It may be developed as notification. So user will not need to click on it, but if user will be hacked - he will see notification.