Email Validation and Verification in Identity Systems Cheat Sheet / 身份系统中的电子邮件验证和验证速查表¶

Introduction / 介绍¶

Email addresses are widely used as primary identifiers in authentication and account recovery workflows. Improper handling of email validation, normalization, and verification can lead to account takeover, user enumeration, and identity confusion.

电子邮件地址在身份验证和账户恢复工作流程中被广泛用作主要标识符。对电子邮件验证、规范化和验证处理不当可能导致账户接管、用户枚举和身份混淆。

This cheat sheet provides guidance on securely handling email addresses within identity systems. See the Authentication Cheat Sheet for broader identity controls.

本速查表提供了在身份系统中安全处理电子邮件地址的指导。有关更广泛的身份控制，请参阅身份验证速查表。

Goals / 目标¶

Safely treat email as an identifier
中文：安全地处理电子邮件作为标识符
Prevent account takeover via email-based flows
中文：防止通过基于电子邮件的流程进行账户接管
Reduce user enumeration risk
中文：降低用户枚举风险
Define secure verification and change workflows
中文：定义安全的验证和变更工作流程

Threat Model / 威胁模型¶

Attackers may attempt to:

攻击者可能会尝试：

Register equivalent or visually similar email addresses
中文：注册等效或视觉上相似的电子邮件地址
Exploit inconsistent normalization logic
中文：利用不一致的规范化逻辑
Abuse password reset functionality
中文：滥用密码重置功能
Enumerate valid accounts
中文：枚举有效账户
Take over accounts through email change workflows
中文：通过电子邮件更改工作流程接管账户

Email Canonicalization / 电子邮件规范表示¶

Applications must define a consistent normalization strategy before storing or comparing email addresses.

应用程序在存储或比较电子邮件地址之前必须定义一致的规范化策略。

Recommendations / 建议¶

Normalize the domain portion to lowercase
中文：将域名部分转换为小写
Avoid provider-specific transformations (e.g., Gmail dot removal) unless fully controlled
中文：除非完全控制，否则避免提供者特定的转换（例如，Gmail点去除）
Store both:
中文：存储以下内容：
- Original input (for display and communication)
  中文：原始输入（用于显示和通信）
- Canonical form (for comparison according to your policy)
  中文：规范形式（用于根据您的策略进行比较）
Document the comparison policy explicitly and apply it consistently across registration, login, password reset, account recovery, and account linking flows
中文：明确记录比较策略，并在注册、登录、密码重置、账户恢复和账户链接流程中一致地应用它

Email Format Validation / 电子邮件格式验证¶

Strict regex-based validation often rejects valid addresses or introduces inconsistencies.

严格的基于正则表达式的验证通常会拒绝有效的地址或引入不一致性。

Recommendations / 建议¶

Use well-tested libraries instead of custom regex
中文：使用经过良好测试的库而不是自定义正则表达式
Accept a broad range of valid formats
中文：接受广泛的有效格式
Reject clearly malformed input only
中文：仅拒绝明显格式错误的输入

Unicode and IDN Considerations / Unicode 和 IDN 考虑因素¶

Unicode introduces spoofing risks via visually similar characters.

Unicode 通过视觉上相似的字符引入欺骗风险。

Recommendations / 建议¶

Normalize Unicode input
中文：规范化 Unicode 输入
Convert internationalized domains to punycode for comparison
中文：将国际化域名转换为 punycode 以进行比较
Be aware of homoglyph attacks (e.g., Latin vs Cyrillic characters)
中文：注意同形异义攻击（例如，拉丁字母与西里尔字母）
Be especially cautious with internationalized local-parts, because normalization and comparison behavior may differ across systems
中文：在国际化本地部分上特别小心，因为不同系统之间的规范化和比较行为可能不同

Case Sensitivity / 大小写敏感¶

Domain part: always case-insensitive
中文：域名部分：始终不区分大小写
Local part: technically case-sensitive under SMTP, though many providers do not enforce this in practice
中文：本地部分：在SMTP中技术上区分大小写，尽管许多提供商在实际操作中并不强制执行

Recommendation / 建议¶

Preserve the original email address as entered by the user
中文：保留用户输入的原电子邮件地址
Define an explicit comparison policy for the local part based on your identity architecture and interoperability requirements
中文：根据您的身份架构和互操作性需求定义一个明确的本地部分比较策略
Only fold or normalize the local part when the system fully owns that behavior and the decision will not create account-collision or mistaken-account risk
中文：仅在系统完全控制该行为且决策不会造成账户冲突或误账户风险时才折叠或归一化本地部分

Email Ownership Verification / 电子邮件所有权验证¶

Email ownership must be verified before enabling account use.

在启用账户使用之前必须验证电子邮件所有权。

Recommendations / 建议¶

Use cryptographically secure, random tokens
中文：使用加密安全的随机令牌
Ensure tokens are:
中文：确保令牌是：
- Single-use
  中文：单次使用
- Time-limited
  中文：限时
Do not activate accounts before verification is completed
中文：在验证完成之前不要激活账户

Password Reset Flows / 密码重置流程¶

Password reset is a high-risk operation. See the Forgot Password Cheat Sheet for recovery controls.

密码重置是一项高风险操作。请参阅忘记密码速查表以获取恢复控制信息。

Recommendations / 建议¶

Use single-use, time-limited tokens
中文：使用一次性、有时间限制的令牌
Do not disclose whether an email exists in the system
中文：不要透露系统中是否存在电子邮件
Invalidate tokens after use or expiration
中文：使用或过期后使令牌失效
Rate limit reset requests
中文：限制重置请求的速率

Email Change Workflows / 电子邮件更改工作流程¶

Changing an email address is equivalent to changing identity.

更改电子邮件地址等同于更改身份。

Recommendations / 建议¶

Require re-authentication
中文：需要重新认证
Notify the existing email address of the change
中文：通知现有电子邮件地址的变更
Require confirmation of the new email address
中文：要求确认新电子邮件地址
Consider requiring confirmation from both addresses for high-risk systems
中文：考虑对高风险系统要求两个地址都进行确认

Anti-Enumeration Controls / 反枚举控制¶

Attackers should not be able to determine whether an email is registered.

攻击者不应能够确定电子邮件是否已注册

Recommendations / 建议¶

Use consistent responses for login and reset flows
中文：对登录和重置流程使用一致的响应
Avoid timing discrepancies between valid and invalid cases
中文：避免有效和无效案例之间的时间差异
Implement rate limiting and monitoring
中文：实施速率限制和监控

Temporary Email Abuse / 临时邮箱滥用¶

Disposable email services can be used to bypass controls.

可使用一次性邮箱服务绕过控制

Recommendations / 建议¶

Maintain a list of known disposable domains if appropriate
中文：如果适当，维护已知的一次性邮箱域名列表
Prefer risk-based controls over strict blocking
中文：优先考虑基于风险的控件而非严格阻止
Monitor for suspicious patterns of account creation
中文：监控可疑的账户创建模式

Email as an Authentication Factor / 电子邮件作为认证因素¶

Email should not be treated as a strong authentication factor.

不应将电子邮件视为强认证因素

Recommendations / 建议¶

Treat email as a weak factor
中文：将电子邮件视为弱因素
Require multi-factor authentication (MFA) for sensitive operations
中文：对敏感操作要求多因素认证（MFA）
Do not rely on email alone for account security
中文：不要仅依赖电子邮件进行账户安全

Logging and Monitoring / 记录和监控¶

Monitoring email-related flows helps detect abuse.

监控与电子邮件相关的流程有助于检测滥用

Recommendations / 建议¶

Log verification attempts and failures
中文：记录验证尝试和失败情况
Monitor password reset activity
中文：监控密码重置活动
Detect abnormal patterns (e.g., high-frequency requests)
中文：检测异常模式（例如，高频请求）
Avoid logging full email addresses; mask or pseudonymize them where logging is necessary (e.g., j***@example.com)
中文：避免记录完整的电子邮件地址；在需要记录时进行掩码或匿名化（例如，j***@example.com）
Never log verification, reset, or authentication tokens or full verification/reset URLs
中文：永远不要记录验证、重置或身份验证令牌或完整的验证/重置URL
Treat email addresses and related identifiers in logs as personal or sensitive data and restrict access accordingly
中文：将日志中的电子邮件地址和相关标识符视为个人信息或敏感数据，并据此限制访问

References / 参考¶

RFC 5322: Internet Message Format) （RFC 5322：互联网消息格式）
RFC 5321: Simple Mail Transfer Protocol) （RFC 5321：简单邮件传输协议）
NIST SP 800-63B-4: Authentication and Authenticator Management) （NIST SP 800-63B-4：身份验证和身份验证器管理）