Search code examples
djangodjango-rest-frameworkdjango-rest-auth

disadvantages to using ACCOUNT_CONFIRM_EMAIL_ON_GET

using Django rest-auth and allauth, using a rest api. I have ACCOUNT_CONFIRM_EMAIL_ON_GET=True. the documentation it gave a warning about this. Are there any major disadvantages to this? this method seems to be perfect for me and i would like to know what trouble this could cause in the long run.

Solution

  • Well it has more to do with what a GET request suppose to do. In many documenations such as MDN web docs or Wikipedia it is mentioned that a GET request should not create a side effect on the server. Meaning making a GET request should not change anything in server side, it should only be used for retrieving data.

    So, I think you should consider this approach (from documentation):

    To avoid requiring user interaction, consider using POST via Javascript in your email confirmation template as an alternative to setting this to True.