Changing email address - best practice

[m85eu]

Sorry if there's a similar topic, but I haven't found anything about it. What's the best practice for updating an email address by user? Is there any ready-to-use solution?

Thanks in advance

[datamweb]

Hi, Is the following explanation not clear enough?
https://codeigniter4.github.io/shield/quickstart/#editing-a-user

[m85eu]

Thank you for your comment. It's clear enough, but I'm wondering about the proper way to handle this and how others do it. Do you simply update the email address, or do you send an activation code before making any changes?

[datamweb]

but I'm wondering about the proper way to handle this and how others do it

I understand what you are looking for. Before anything, you should know that our policy in Shield is to provide the necessary tools for the developer, so we have tried to provide everything needed to create the desired processes by the developer.
This means that by default we don't have a forgotten password form, a password change form, or admin panel and etc, but we have provided everything the developer needs to implement these things.

Do you simply update the email address,

This issue is completely dependent on the project. In some cases, there is no special sensitivity or it is not possible to change the email after registration by the user himself and it must be edited by the admin.

do you send an activation code before making any changes?
In some cases, as you said, there is a need to send the activation code.

If I want to implement something like this, I will proceed as follows.

1. The user must login the panel.
2. I create an email change form.
3. The form must include a new email and password.
4. I check that the previous email with a valid password is correct.
5. If it is valid, I will send a confirmation link to the previous email.
6. The user see the link and its status changes to inactive.
7. Now I send a new link to the new email and wait for the confirmation of the email address by the user.
8. If the email is confirmed, I will change the user's status to active.

I wrote the above very quickly, it may need to change, however the general process will be the same.

[kenjis]

Email is the most important data (in Shield) for authentication and should be verified by sending a confirmation email.