Implement Email Verification to Prevent Access With Unverified Emails in Auth0
Last Updated:
Overview
Implementing email verification prevents users with unverified email addresses from continuing after registration or sign-in. Enforce email verification by using a post-login Action to deny access or by sending a verification email using Forms for Actions. This configuration ensures that only verified users access the application and displays an informative message to unverified users.
Applies To
- Auth0
- Enforce Email Verification
- Denied Access
- Forms
Solution
How does a post-login Action deny access?
This approach checks the email_verified property after a user signs in. If the email is not verified, Auth0 denies access to the application.
Create a post-login Action and configure it to deny access for unverified emails as detailed in either the video demonstration or the written instructions.
- Create a post-login Action.
- Within the Action, access the
event.user.email_verifiedproperty. - If
event.user.email_verifiedisfalse, use theapi.access.deny()method and provide a message that informs the user to verify the email address.
NOTE: This action redirects the user back to the application's callback endpoint. Configure the callback endpoint to parse the error and display a user-friendly message.
Review the following example post-login Action code:
exports.onExecutePostLogin = async (event, api) => {
if (!event.user.email_verified) {
api.access.deny('Please verify your email before logging in.');
}
};
Send a Verification Email Using Forms for Actions
The Forms for Actions feature provides a template for the email verification process.
Review the following requirements and behaviors for this feature.
- Administrators must enable the tenant-level Email Provider.
- This feature sends a verification email each time the user signs in and the specific Form is invoked.
- The feature remains effective even if an initial verification email expires.
Review the following image for an example of the Forms Templates interface.