Designing an new user confirmation (verify via email)

Question

I am developing an ASP.Net application that will need to verify that the user is legit and not a spam. Once the new user enters their first name, last name, email address, my application will send an email to verify the user's authenticity. The email would conatin a link that would confirm the users account.

I am looking help on what the logic is behind the email link. Once the user clicks the link, what happens?

I have had a website that has used Captcha, and not had much luck stopping spam (I know you can't stop 100% spam) similar to this Stopping spammers from creating accounts (reCaptcha not doing the trick)

Answer 1

As Rook has pointed out below, the simplest way is to use Captcha.

If you need to verify the email as well though, see below.

---

You could generate an approval GUID and pass it to the email URL which would mark the User as Active.

For example, add a column called ApprovalID to the users table and generate a new GUID when the user registers, i.e.

You should mark the user as inactive at this stage.

Example Guid 3F2504E0-4F89-11D3-9A0C-0305E82C3301 

Then pass the User Id and GUID in the email body

<a href="http://www.mysite.com/verify.aspx?UserId=TheUserId&ApprovalId=3F2504E0-4F89-11D3-9A0C-0305E82C3301">Verify your account</a>

Then a simple page verify.aspx

Code Behind

string UserId = Request[UserId].ToString(); // You can parse these as Guids
string ApprovalId = Request[ApprovalId].ToString();

TODO:
// Get user from database
// Match QueryString ApprovalId to Column ApprovalId
// Ask user to Log In
// Set user as active