How to reset a user’s password before email verification?
I'm designing a basic registration and login system.
The site sends a confirmation email on registration with a 6-digit OTP.
Of course, it is possible that a user does not complete this email verification step.
Suppose later the user attempts to login. It seems the user should be able to login with their username+password, and then be prompted again to verify their email.
However, what if they have forgotten their password? It seems there are a few choices here:
- Send a password reset link to the unverified email
- Disallow a password reset (and the user can never login)
- Disallow a password reset, and make the verification part of the registration process, thereby deleting the user if the email verification is not completed in time.
- Something else?
One might attempt to circumvent this by having an "email verification link" rather than an OTP, but the email verification link can (and probably should) have an expiration date, after which we have the same problem.