mattupstate/flask-security — pull request #134 by rxl (2013-07-11 18:17:15+00:00)
Title: Email confirmation fix

Email confirmation can be a useful feature, but requiring email confirmation in order to log in can diminish the quality of the user experience (http://www.quora.com/Is-requiring-email-confirmation-bad-for-user-experience). That is why I opted to work with the following settings:

SECURITY_CONFIRMABLE = True
SECURITY_LOGIN_WITHOUT_CONFIRMATION = True

However, with these settings, email confirmation doesn't actually work. Here's why:

User registers
User is logged in
User receives a confirmation email
User clicks the confirmation email link
/confirm/ has "@anonymous_user_required" enabled and so doesn't actually lead to user confirmation (you can verify this by looking in your db under the "confirmed_at" field)
TL;DR: email confirmation only works if the user logs out after registering and before clicking the link (clearly a problem)

There are two lines of code that could be added to fix this:

Remove "@anonymous_user_required" as a decorator of "confirm_email(token)"
Add "logout_user()" as the first line of "confirm_email(token)"
Note that this change is compatible with the following settings as well:

SECURITY_CONFIRMABLE = True
SECURITY_LOGIN_WITHOUT_CONFIRMATION = False

That is because even if a different user is currently logged in, that user will be logged out and then the user tied to the confirmation link will have their email confirmed and will be logged in.

I'd like to go ahead and make the quick changes and would really appreciate your feedback.