Post-it Code

If you manage applications, you may encounter users who register multiple accounts using variations of the same Gmail address (or other email providers with a similar feature). This allows them to exploit your account creation process without needing to create entirely new email addresses. As Google explains:  Dots don't matter in Gmail addresses Screenshot from Google Article While this may seem like a minor issue, it can have significant implications for your application. When performing duplicate account checks, simply relying on a unique index in your database is insufficient. To safeguard your application, ensure that you normalise email addresses by removing dots in the local part before conducting duplicate checks. This small adjustment can prevent exploitation and maintain the integrity of your user database. Disclosure:  This entry is based on a collection of my personal notes, and some of the information may be outdated or no longer relevant. If you notice any inacc...

When implementing email validation, many of us focus solely on the structure of the email (Regex, anyone?). However, understanding the character limit specifications is equally important and often overlooked. RFC 3696 states "That limit is a maximum of 64 characters (octets) in the "local part" (before the "@") and a maximum of 255 characters (octets) in the domain part (after the "@") for a total length of 320 characters." Source:  RFC 3696 In simpler terms: [local portion]@[domain portion] (i.e. john@website.com)   The local portion before "@":  64 characters "@" itself: 1 character The domain portion after "@":  255 characters   The total length cannot exceed 320 characters (64 + 1 + 255) Understanding these character limits is crucial when validating email addresses, as exceeding them can cause issues with email delivery and may compromise the security of your application. Disclosure:  This entry is based on a c...