title: Is this a reasonable user registration process?
body: <p>I'm working on a registration process for an internal application. My initial design is below.</p>
  
  <p>My main question is whether it's really necessary to include a <code>registration_confirmation_code</code>. Does it protect the app from a realistic threat or just add unnecessary complexity? I'm not sure about that.</p>
  
  <hr>
  
  <ul>
  <li><p>User enters email address. Since this is an internal app, it has to be an agency address.</p></li>
  <li><p>If it's a valid agency address, app creates a new row in the users table.</p>
  
  <ul>
  <li><p>The table has a column <code>registration_confirmed</code> which is <code>false</code> by default. App won't let a user log in unless <code>registration_confirmed</code> is <code>true</code>.</p></li>
  <li><p>The table has a column <code>registration_confirmation_code</code> which is a randomly-generated string.</p></li>
  </ul></li>
  <li><p>App sends an email to the address the user entered. It contains a link to a page that will let the user confirm their registration and set their username and password.</p>
  
  <p>The link has the user's <code>id</code> and <code>registration_confirmation_code</code> in the query string:</p>
  
  <p><code>http://agencydomain.com/users?id=123&amp;registration_confirmation_code=fab49dk34nw97d</code></p></li>
  <li><p>By clicking on the link the user verifies that the address they entered is valid and that they have access to it.</p></li>
  <li><p>The app finds the user by ID. Before allowing them to visit the page where they can set their username and password, the app checks that...</p>
  
  <ul>
  <li><p><code>registration_confirmed</code> is <code>false</code>. They should only be able to confirm their registration once.</p></li>
  <li><p><code>registration_confirmation_code</code> request param matches the value in the DB for that user. That ensures this is a legitimate registration confirmation by the intended user and not someone else hitting the URL with random IDs trying to hijack a registration.</p></li>
  </ul></li>
  <li><p>If everything checks out, the app takes them to a page with a form for setting their username and password.</p></li>
  <li><p>When they submit the form with valid data, app sets <code>registration_confirmed</code> to <code>true</code> and they are registered.</p></li>
  </ul>