I’m writing a web application in Java where at some point user can enter there email address to receive an email. My question is about the verification of this email address (so it’s not about the validation!). I’m tagging this question also with google-app-engine, because the application will live there, but I don’t think that matters too much.
Anyway, for people who have a google account I use the app engine’s User API to verify that address, but for other people I would like to send a verification email, that provides them with an URL. Very standard I would think, but are there also standard ways to generate the URL? Or is just creating a hash of the email address, storing that in a database and putting it as a parameter in the URL sufficient?
I wouldn’t use e-mail hash in verification e-mail. That would be to easy to guess and someone could actually try to falsify that.
If I were to implement it, I would add random GUID and store it to the DB for verification. I don’t know if it is standard way to do verification or not…